* [Enable measured boot with SM3 digest algorithm 1/4] sm3_enabling: Augment crypt interface with calls into openssl to calculate sm3 digest prior to exercising TPM2 calls for PCR extend
2019-05-17 18:31 [Enable measured boot with SM3 digest algorithm 0/4] Imran Desai
@ 2019-05-17 18:31 ` Imran Desai
2019-05-17 18:31 ` [Enable measured boot with SM3 digest algorithm 2/4] sm3-enabling: Add SM3 TCG algorithm registry value to the PcdTpm2HashMask Imran Desai
` (4 subsequent siblings)
5 siblings, 0 replies; 9+ messages in thread
From: Imran Desai @ 2019-05-17 18:31 UTC (permalink / raw)
To: devel
---
OvmfPkg/OvmfPkgX64.dsc | 2 +
SecurityPkg/Library/HashInstanceLibSm3/HashInstanceLibSm3.inf | 46 ++++++
MdePkg/Include/Protocol/Hash.h | 5 +
SecurityPkg/Include/Library/HashLib.h | 1 +
SecurityPkg/Library/HashInstanceLibSm3/HashInstanceLibSm3.c | 155 ++++++++++++++++++++
SecurityPkg/Library/HashInstanceLibSm3/HashInstanceLibSm3.uni | 21 +++
6 files changed, 230 insertions(+)
diff --git a/OvmfPkg/OvmfPkgX64.dsc b/OvmfPkg/OvmfPkgX64.dsc
index 733a4c9d8a43..7e46d401a36f 100644
--- a/OvmfPkg/OvmfPkgX64.dsc
+++ b/OvmfPkg/OvmfPkgX64.dsc
@@ -635,6 +635,7 @@ [Components]
NULL|SecurityPkg/Library/HashInstanceLibSha256/HashInstanceLibSha256.inf
NULL|SecurityPkg/Library/HashInstanceLibSha384/HashInstanceLibSha384.inf
NULL|SecurityPkg/Library/HashInstanceLibSha512/HashInstanceLibSha512.inf
+ NULL|SecurityPkg/Library/HashInstanceLibSm3/HashInstanceLibSm3.inf
}
!if $(TPM2_CONFIG_ENABLE) == TRUE
SecurityPkg/Tcg/Tcg2Config/Tcg2ConfigDxe.inf
@@ -922,5 +923,6 @@ [Components]
NULL|SecurityPkg/Library/HashInstanceLibSha256/HashInstanceLibSha256.inf
NULL|SecurityPkg/Library/HashInstanceLibSha384/HashInstanceLibSha384.inf
NULL|SecurityPkg/Library/HashInstanceLibSha512/HashInstanceLibSha512.inf
+ NULL|SecurityPkg/Library/HashInstanceLibSm3/HashInstanceLibSm3.inf
}
!endif
diff --git a/SecurityPkg/Library/HashInstanceLibSm3/HashInstanceLibSm3.inf b/SecurityPkg/Library/HashInstanceLibSm3/HashInstanceLibSm3.inf
new file mode 100644
index 000000000000..b2c68b784211
--- /dev/null
+++ b/SecurityPkg/Library/HashInstanceLibSm3/HashInstanceLibSm3.inf
@@ -0,0 +1,46 @@
+## @file
+# Provides BaseCrypto SM3 hash service
+#
+# This library can be registered to BaseCrypto router, to serve as hash engine.
+#
+# Copyright (c) 2013 - 2018, Intel Corporation. All rights reserved.<BR>
+# This program and the accompanying materials
+# are licensed and made available under the terms and conditions of the BSD License
+# which accompanies this distribution. The full text of the license may be found at
+# http://opensource.org/licenses/bsd-license.php
+# THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
+# WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
+#
+##
+
+[Defines]
+ INF_VERSION = 0x00010005
+ BASE_NAME = HashInstanceLibSm3
+ MODULE_UNI_FILE = HashInstanceLibSm3.uni
+ FILE_GUID = C5865D5D-9ACE-39FB-DC7C-0511891D40F9
+ MODULE_TYPE = BASE
+ VERSION_STRING = 1.0
+ LIBRARY_CLASS = NULL
+ CONSTRUCTOR = HashInstanceLibSm3Constructor
+
+#
+# The following information is for reference only and not required by the build tools.
+#
+# VALID_ARCHITECTURES = IA32 X64
+#
+
+[Sources]
+ HashInstanceLibSm3.c
+
+[Packages]
+ MdePkg/MdePkg.dec
+ SecurityPkg/SecurityPkg.dec
+ CryptoPkg/CryptoPkg.dec
+
+[LibraryClasses]
+ BaseLib
+ BaseMemoryLib
+ DebugLib
+ Tpm2CommandLib
+ MemoryAllocationLib
+ BaseCryptLib
diff --git a/MdePkg/Include/Protocol/Hash.h b/MdePkg/Include/Protocol/Hash.h
index 931d7916ef1e..8abf1a4fa305 100644
--- a/MdePkg/Include/Protocol/Hash.h
+++ b/MdePkg/Include/Protocol/Hash.h
@@ -48,6 +48,11 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
0xcaa4381e, 0x750c, 0x4770, {0xb8, 0x70, 0x7a, 0x23, 0xb4, 0xe4, 0x21, 0x30 } \
}
+#define EFI_HASH_ALGORITHM_SM3_256_GUID \
+ { \
+ 0x251C7818, 0x0DBF, 0xE619, { 0x7F, 0xC2, 0xD6, 0xAC, 0x43, 0x42, 0x7D, 0xA3 } \
+ }
+
#define EFI_HASH_ALGORTIHM_MD5_GUID \
{ \
0xaf7c79c, 0x65b5, 0x4319, {0xb0, 0xae, 0x44, 0xec, 0x48, 0x4e, 0x4a, 0xd7 } \
diff --git a/SecurityPkg/Include/Library/HashLib.h b/SecurityPkg/Include/Library/HashLib.h
index 63f08398788b..24b4c425d7b8 100644
--- a/SecurityPkg/Include/Library/HashLib.h
+++ b/SecurityPkg/Include/Library/HashLib.h
@@ -137,6 +137,7 @@ EFI_STATUS
#define HASH_ALGORITHM_SHA256_GUID EFI_HASH_ALGORITHM_SHA256_GUID
#define HASH_ALGORITHM_SHA384_GUID EFI_HASH_ALGORITHM_SHA384_GUID
#define HASH_ALGORITHM_SHA512_GUID EFI_HASH_ALGORITHM_SHA512_GUID
+#define HASH_ALGORITHM_SM3_256_GUID EFI_HASH_ALGORITHM_SM3_256_GUID
typedef struct {
EFI_GUID HashGuid;
diff --git a/SecurityPkg/Library/HashInstanceLibSm3/HashInstanceLibSm3.c b/SecurityPkg/Library/HashInstanceLibSm3/HashInstanceLibSm3.c
new file mode 100644
index 000000000000..504475ca193a
--- /dev/null
+++ b/SecurityPkg/Library/HashInstanceLibSm3/HashInstanceLibSm3.c
@@ -0,0 +1,155 @@
+/** @file
+ This library is BaseCrypto SM3 hash instance.
+ It can be registered to BaseCrypto router, to serve as hash engine.
+
+Copyright (c) 2013 - 2018, Intel Corporation. All rights reserved. <BR>
+This program and the accompanying materials
+are licensed and made available under the terms and conditions of the BSD License
+which accompanies this distribution. The full text of the license may be found at
+http://opensource.org/licenses/bsd-license.php
+
+THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
+WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
+
+**/
+
+#include <PiPei.h>
+#include <Library/BaseLib.h>
+#include <Library/BaseMemoryLib.h>
+#include <Library/Tpm2CommandLib.h>
+#include <Library/DebugLib.h>
+#include <Library/BaseCryptLib.h>
+#include <Library/MemoryAllocationLib.h>
+#include <Library/HashLib.h>
+
+/**
+ The function set SM3 to digest list.
+
+ @param DigestList digest list
+ @param Sm3Digest SM3 digest
+**/
+VOID
+Tpm2SetSm3ToDigestList (
+ IN TPML_DIGEST_VALUES *DigestList,
+ IN UINT8 *Sm3Digest
+ )
+{
+ DigestList->count = 1;
+ DigestList->digests[0].hashAlg = TPM_ALG_SM3_256;
+ CopyMem (
+ DigestList->digests[0].digest.sm3_256,
+ Sm3Digest,
+ SM3_256_DIGEST_SIZE
+ );
+}
+
+/**
+ Start hash sequence.
+
+ @param HashHandle Hash handle.
+
+ @retval EFI_SUCCESS Hash sequence start and HandleHandle returned.
+ @retval EFI_OUT_OF_RESOURCES No enough resource to start hash.
+**/
+EFI_STATUS
+EFIAPI
+Sm3HashInit (
+ OUT HASH_HANDLE *HashHandle
+ )
+{
+ VOID *Sm3Ctx;
+ UINTN CtxSize;
+
+ CtxSize = Sm3GetContextSize ();
+ Sm3Ctx = AllocatePool (CtxSize);
+ ASSERT (Sm3Ctx != NULL);
+
+ Sm3Init (Sm3Ctx);
+
+ *HashHandle = (HASH_HANDLE)Sm3Ctx;
+
+ return EFI_SUCCESS;
+}
+
+/**
+ Update hash sequence data.
+
+ @param HashHandle Hash handle.
+ @param DataToHash Data to be hashed.
+ @param DataToHashLen Data size.
+
+ @retval EFI_SUCCESS Hash sequence updated.
+**/
+EFI_STATUS
+EFIAPI
+Sm3HashUpdate (
+ IN HASH_HANDLE HashHandle,
+ IN VOID *DataToHash,
+ IN UINTN DataToHashLen
+ )
+{
+ VOID *Sm3Ctx;
+
+ Sm3Ctx = (VOID *)HashHandle;
+ Sm3Update (Sm3Ctx, DataToHash, DataToHashLen);
+
+ return EFI_SUCCESS;
+}
+
+/**
+ Complete hash sequence complete.
+
+ @param HashHandle Hash handle.
+ @param DigestList Digest list.
+
+ @retval EFI_SUCCESS Hash sequence complete and DigestList is returned.
+**/
+EFI_STATUS
+EFIAPI
+Sm3HashFinal (
+ IN HASH_HANDLE HashHandle,
+ OUT TPML_DIGEST_VALUES *DigestList
+ )
+{
+ UINT8 Digest[SM3_256_DIGEST_SIZE];
+ VOID *Sm3Ctx;
+
+ Sm3Ctx = (VOID *)HashHandle;
+ Sm3Final (Sm3Ctx, Digest);
+
+ FreePool (Sm3Ctx);
+
+ Tpm2SetSm3ToDigestList (DigestList, Digest);
+
+ return EFI_SUCCESS;
+}
+
+HASH_INTERFACE mSm3InternalHashInstance = {
+ HASH_ALGORITHM_SM3_256_GUID,
+ Sm3HashInit,
+ Sm3HashUpdate,
+ Sm3HashFinal,
+};
+
+/**
+ The function register SM3 instance.
+
+ @retval EFI_SUCCESS SM3 instance is registered, or system dose not support register SM3 instance
+**/
+EFI_STATUS
+EFIAPI
+HashInstanceLibSm3Constructor (
+ VOID
+ )
+{
+ EFI_STATUS Status;
+
+ Status = RegisterHashInterfaceLib (&mSm3InternalHashInstance);
+ if ((Status == EFI_SUCCESS) || (Status == EFI_UNSUPPORTED)) {
+ //
+ // Unsupported means platform policy does not need this instance enabled.
+ //
+ return EFI_SUCCESS;
+ }
+ return Status;
+}
diff --git a/SecurityPkg/Library/HashInstanceLibSm3/HashInstanceLibSm3.uni b/SecurityPkg/Library/HashInstanceLibSm3/HashInstanceLibSm3.uni
new file mode 100644
index 000000000000..8d985feeaca1
--- /dev/null
+++ b/SecurityPkg/Library/HashInstanceLibSm3/HashInstanceLibSm3.uni
@@ -0,0 +1,21 @@
+// /** @file
+// Provides BaseCrypto SM3 hash service
+//
+// This library can be registered to BaseCrypto router, to serve as hash engine.
+//
+// Copyright (c) 2013 - 2014, Intel Corporation. All rights reserved.<BR>
+//
+// This program and the accompanying materials
+// are licensed and made available under the terms and conditions of the BSD License
+// which accompanies this distribution. The full text of the license may be found at
+// http://opensource.org/licenses/bsd-license.php
+// THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
+// WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
+//
+// **/
+
+
+#string STR_MODULE_ABSTRACT #language en-US "Provides BaseCrypto SM3 hash service"
+
+#string STR_MODULE_DESCRIPTION #language en-US "This library can be registered to BaseCrypto router, to serve as hash engine."
+
--
2.17.0
^ permalink raw reply related [flat|nested] 9+ messages in thread* [Enable measured boot with SM3 digest algorithm 2/4] sm3-enabling: Add SM3 TCG algorithm registry value to the PcdTpm2HashMask
2019-05-17 18:31 [Enable measured boot with SM3 digest algorithm 0/4] Imran Desai
2019-05-17 18:31 ` [Enable measured boot with SM3 digest algorithm 1/4] sm3_enabling: Augment crypt interface with calls into openssl to calculate sm3 digest prior to exercising TPM2 calls for PCR extend Imran Desai
@ 2019-05-17 18:31 ` Imran Desai
2019-05-17 18:31 ` [Enable measured boot with SM3 digest algorithm 3/4] sm3-enabling: Add SM3 guid reference in the TPM2 hash mask structure in HashLibBaseCryptoRouterCommon.c Imran Desai
` (3 subsequent siblings)
5 siblings, 0 replies; 9+ messages in thread
From: Imran Desai @ 2019-05-17 18:31 UTC (permalink / raw)
To: devel
---
SecurityPkg/SecurityPkg.dec | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/SecurityPkg/SecurityPkg.dec b/SecurityPkg/SecurityPkg.dec
index 3314f1854be4..fa3a4fcf5869 100644
--- a/SecurityPkg/SecurityPkg.dec
+++ b/SecurityPkg/SecurityPkg.dec
@@ -438,9 +438,10 @@ [PcdsDynamic, PcdsDynamicEx]
# BIT1 - SHA256.<BR>
# BIT2 - SHA384.<BR>
# BIT3 - SHA512.<BR>
+ # BIT4 - SM3_256.<BR>
# @Prompt Hash mask for TPM 2.0
- # @ValidRange 0x80000001 | 0x00000000 - 0x0000000F
- gEfiSecurityPkgTokenSpaceGuid.PcdTpm2HashMask|0x0000000F|UINT32|0x00010010
+ # @ValidRange 0x80000001 | 0x00000000 - 0x0000001F
+ gEfiSecurityPkgTokenSpaceGuid.PcdTpm2HashMask|0x0000001F|UINT32|0x00010010
## This PCD indicated final BIOS supported Hash mask.
# Bios may choose to register a subset of PcdTpm2HashMask.
--
2.17.0
^ permalink raw reply related [flat|nested] 9+ messages in thread* [Enable measured boot with SM3 digest algorithm 3/4] sm3-enabling: Add SM3 guid reference in the TPM2 hash mask structure in HashLibBaseCryptoRouterCommon.c
2019-05-17 18:31 [Enable measured boot with SM3 digest algorithm 0/4] Imran Desai
2019-05-17 18:31 ` [Enable measured boot with SM3 digest algorithm 1/4] sm3_enabling: Augment crypt interface with calls into openssl to calculate sm3 digest prior to exercising TPM2 calls for PCR extend Imran Desai
2019-05-17 18:31 ` [Enable measured boot with SM3 digest algorithm 2/4] sm3-enabling: Add SM3 TCG algorithm registry value to the PcdTpm2HashMask Imran Desai
@ 2019-05-17 18:31 ` Imran Desai
2019-05-17 18:31 ` [Enable measured boot with SM3 digest algorithm 4/4] sm3-enabling: Add SM3 hashinstance library information to all OvmfPkg and SecurityPkg Imran Desai
` (2 subsequent siblings)
5 siblings, 0 replies; 9+ messages in thread
From: Imran Desai @ 2019-05-17 18:31 UTC (permalink / raw)
To: devel
---
SecurityPkg/Library/HashLibBaseCryptoRouter/HashLibBaseCryptoRouterCommon.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/SecurityPkg/Library/HashLibBaseCryptoRouter/HashLibBaseCryptoRouterCommon.c b/SecurityPkg/Library/HashLibBaseCryptoRouter/HashLibBaseCryptoRouterCommon.c
index 7f3bdab53066..aec874a9e072 100644
--- a/SecurityPkg/Library/HashLibBaseCryptoRouter/HashLibBaseCryptoRouterCommon.c
+++ b/SecurityPkg/Library/HashLibBaseCryptoRouter/HashLibBaseCryptoRouterCommon.c
@@ -25,6 +25,7 @@ TPM2_HASH_MASK mTpm2HashMask[] = {
{HASH_ALGORITHM_SHA256_GUID, HASH_ALG_SHA256},
{HASH_ALGORITHM_SHA384_GUID, HASH_ALG_SHA384},
{HASH_ALGORITHM_SHA512_GUID, HASH_ALG_SHA512},
+ {HASH_ALGORITHM_SM3_256_GUID, HASH_ALG_SM3_256},
};
/**
--
2.17.0
^ permalink raw reply related [flat|nested] 9+ messages in thread* [Enable measured boot with SM3 digest algorithm 4/4] sm3-enabling: Add SM3 hashinstance library information to all OvmfPkg and SecurityPkg
2019-05-17 18:31 [Enable measured boot with SM3 digest algorithm 0/4] Imran Desai
` (2 preceding siblings ...)
2019-05-17 18:31 ` [Enable measured boot with SM3 digest algorithm 3/4] sm3-enabling: Add SM3 guid reference in the TPM2 hash mask structure in HashLibBaseCryptoRouterCommon.c Imran Desai
@ 2019-05-17 18:31 ` Imran Desai
2019-05-20 16:23 ` [edk2-devel] [Enable measured boot with SM3 digest algorithm 0/4] Laszlo Ersek
2019-05-20 16:30 ` Yao, Jiewen
5 siblings, 0 replies; 9+ messages in thread
From: Imran Desai @ 2019-05-17 18:31 UTC (permalink / raw)
To: devel
---
OvmfPkg/OvmfPkgIa32.dsc | 2 ++
OvmfPkg/OvmfPkgIa32X64.dsc | 2 ++
SecurityPkg/SecurityPkg.dsc | 3 +++
3 files changed, 7 insertions(+)
diff --git a/OvmfPkg/OvmfPkgIa32.dsc b/OvmfPkg/OvmfPkgIa32.dsc
index 578fc6c98ec8..fb5944aa6945 100644
--- a/OvmfPkg/OvmfPkgIa32.dsc
+++ b/OvmfPkg/OvmfPkgIa32.dsc
@@ -628,6 +628,7 @@ [Components]
NULL|SecurityPkg/Library/HashInstanceLibSha256/HashInstanceLibSha256.inf
NULL|SecurityPkg/Library/HashInstanceLibSha384/HashInstanceLibSha384.inf
NULL|SecurityPkg/Library/HashInstanceLibSha512/HashInstanceLibSha512.inf
+ NULL|SecurityPkg/Library/HashInstanceLibSm3/HashInstanceLibSm3.inf
}
!if $(TPM2_CONFIG_ENABLE) == TRUE
SecurityPkg/Tcg/Tcg2Config/Tcg2ConfigDxe.inf
@@ -914,5 +915,6 @@ [Components]
NULL|SecurityPkg/Library/HashInstanceLibSha256/HashInstanceLibSha256.inf
NULL|SecurityPkg/Library/HashInstanceLibSha384/HashInstanceLibSha384.inf
NULL|SecurityPkg/Library/HashInstanceLibSha512/HashInstanceLibSha512.inf
+ NULL|SecurityPkg/Library/HashInstanceLibSm3/HashInstanceLibSm3.inf
}
!endif
diff --git a/OvmfPkg/OvmfPkgIa32X64.dsc b/OvmfPkg/OvmfPkgIa32X64.dsc
index eade8f62d3de..64c231f735c2 100644
--- a/OvmfPkg/OvmfPkgIa32X64.dsc
+++ b/OvmfPkg/OvmfPkgIa32X64.dsc
@@ -636,6 +636,7 @@ [Components.IA32]
NULL|SecurityPkg/Library/HashInstanceLibSha256/HashInstanceLibSha256.inf
NULL|SecurityPkg/Library/HashInstanceLibSha384/HashInstanceLibSha384.inf
NULL|SecurityPkg/Library/HashInstanceLibSha512/HashInstanceLibSha512.inf
+ NULL|SecurityPkg/Library/HashInstanceLibSm3/HashInstanceLibSm3.inf
}
!if $(TPM2_CONFIG_ENABLE) == TRUE
SecurityPkg/Tcg/Tcg2Config/Tcg2ConfigDxe.inf
@@ -924,5 +925,6 @@ [Components.X64]
NULL|SecurityPkg/Library/HashInstanceLibSha256/HashInstanceLibSha256.inf
NULL|SecurityPkg/Library/HashInstanceLibSha384/HashInstanceLibSha384.inf
NULL|SecurityPkg/Library/HashInstanceLibSha512/HashInstanceLibSha512.inf
+ NULL|SecurityPkg/Library/HashInstanceLibSm3/HashInstanceLibSm3.inf
}
!endif
diff --git a/SecurityPkg/SecurityPkg.dsc b/SecurityPkg/SecurityPkg.dsc
index a2ee0528f0d2..044319ab5e36 100644
--- a/SecurityPkg/SecurityPkg.dsc
+++ b/SecurityPkg/SecurityPkg.dsc
@@ -222,6 +222,7 @@ [Components.IA32, Components.X64]
SecurityPkg/Library/HashInstanceLibSha256/HashInstanceLibSha256.inf
SecurityPkg/Library/HashInstanceLibSha384/HashInstanceLibSha384.inf
SecurityPkg/Library/HashInstanceLibSha512/HashInstanceLibSha512.inf
+ SecurityPkg/Library/HashInstanceLibSm3/HashInstanceLibSm3.inf
SecurityPkg/Tcg/Tcg2Config/Tcg2ConfigPei.inf {
<LibraryClasses>
@@ -236,6 +237,7 @@ [Components.IA32, Components.X64]
NULL|SecurityPkg/Library/HashInstanceLibSha256/HashInstanceLibSha256.inf
NULL|SecurityPkg/Library/HashInstanceLibSha384/HashInstanceLibSha384.inf
NULL|SecurityPkg/Library/HashInstanceLibSha512/HashInstanceLibSha512.inf
+ NULL|SecurityPkg/Library/HashInstanceLibSm3/HashInstanceLibSm3.inf
}
SecurityPkg/Tcg/Tcg2Dxe/Tcg2Dxe.inf {
@@ -246,6 +248,7 @@ [Components.IA32, Components.X64]
NULL|SecurityPkg/Library/HashInstanceLibSha256/HashInstanceLibSha256.inf
NULL|SecurityPkg/Library/HashInstanceLibSha384/HashInstanceLibSha384.inf
NULL|SecurityPkg/Library/HashInstanceLibSha512/HashInstanceLibSha512.inf
+ NULL|SecurityPkg/Library/HashInstanceLibSm3/HashInstanceLibSm3.inf
PcdLib|MdePkg/Library/DxePcdLib/DxePcdLib.inf
}
SecurityPkg/Tcg/Tcg2Config/Tcg2ConfigDxe.inf {
--
2.17.0
^ permalink raw reply related [flat|nested] 9+ messages in thread* Re: [edk2-devel] [Enable measured boot with SM3 digest algorithm 0/4]
2019-05-17 18:31 [Enable measured boot with SM3 digest algorithm 0/4] Imran Desai
` (3 preceding siblings ...)
2019-05-17 18:31 ` [Enable measured boot with SM3 digest algorithm 4/4] sm3-enabling: Add SM3 hashinstance library information to all OvmfPkg and SecurityPkg Imran Desai
@ 2019-05-20 16:23 ` Laszlo Ersek
2019-05-20 16:30 ` Yao, Jiewen
5 siblings, 0 replies; 9+ messages in thread
From: Laszlo Ersek @ 2019-05-20 16:23 UTC (permalink / raw)
To: imran.desai
Cc: devel, Michael D Kinney, Liming Gao, Chao Zhang, Jiewen Yao,
Jian Wang, Jordan Justen, Ard Biesheuvel, Marc-André Lureau,
Stefan Berger
Hi Imran,
On 05/17/19 20:31, Imran Desai wrote:
> https://github.com/idesai/edk2/tree/enable_sm3_measured_boot
>
> Support for SM3 digest algorithm is needed for TPM with SM3 PCR banks.
> This digest algorithm is part of the China Crypto algorithm suite.
> Support for these algorithms is needed to enable platforms for the PRC
> market.
> This integration has dependency on the openssl_1_1_1b integration into
> edk2.
>
> Imran Desai (4):
> sm3_enabling: Augment crypt interface with calls into openssl to
> calculate sm3 digest prior to exercising TPM2 calls for PCR extend
> sm3-enabling: Add SM3 TCG algorithm registry value to the
> PcdTpm2HashMask
> sm3-enabling: Add SM3 guid reference in the TPM2 hash mask structure
> in HashLibBaseCryptoRouterCommon.c
> sm3-enabling: Add SM3 hashinstance library information to all
> OvmfPkg and SecurityPkg
>
> SecurityPkg/SecurityPkg.dec | 5 +-
> OvmfPkg/OvmfPkgIa32.dsc | 2 +
> OvmfPkg/OvmfPkgIa32X64.dsc | 2 +
> OvmfPkg/OvmfPkgX64.dsc | 2 +
> SecurityPkg/SecurityPkg.dsc | 3 +
> .../HashInstanceLibSm3/HashInstanceLibSm3.inf | 46 ++++++
> MdePkg/Include/Protocol/Hash.h | 5 +
> SecurityPkg/Include/Library/HashLib.h | 1 +
> .../HashInstanceLibSm3/HashInstanceLibSm3.c | 155 ++++++++++++++++++
> .../HashLibBaseCryptoRouterCommon.c | 1 +
> .../HashInstanceLibSm3/HashInstanceLibSm3.uni | 21 +++
> 11 files changed, 241 insertions(+), 2 deletions(-)
> create mode 100644 SecurityPkg/Library/HashInstanceLibSm3/HashInstanceLibSm3.inf
> create mode 100644 SecurityPkg/Library/HashInstanceLibSm3/HashInstanceLibSm3.c
> create mode 100644 SecurityPkg/Library/HashInstanceLibSm3/HashInstanceLibSm3.uni
>
(1) Please refer to:
https://github.com/tianocore/tianocore.github.io/wiki/Commit-Message-Format
for the commit message format. In particular,
- the subject prefix should simply be [PATCH]
- the bugzilla URL should be referenced in every commit message
- you should have a subject line on each patch that's not longer than
72-74 characters
- you should have a non-empty commit message body (similarly wrapped to
72-74 characters) in every patch
- you should add your Signed-off-by to every patch.
(2) Any given patch should not cross module or package directories, if
possible. In addition, the patch series should be built logically, in
stages. First, the foundation should be laid, and the rest should be
built upon the foundation.
Thus, below, I suggest a (hopefully better) structure for your patch
series. Note that this is only a structural overview; I'll have more
comments at the bottom.
(2a) PATCH v2 1/5:
Subject:
MdePkg/Protocol/Hash: introduce GUID for SM3 digest algorithm
Package maintainers to CC (see "MdePkg" in "Maintainers.txt"):
Cc: Michael D Kinney <michael.d.kinney@intel.com>
Cc: Liming Gao <liming.gao@intel.com>
Modify only the following files in this patch:
MdePkg/Include/Protocol/Hash.h
(2b) PATCH v2 2/5:
Subject:
SecurityPkg: introduce the SM3 digest algorithm
Package maintainers to CC:
Cc: Chao Zhang <chao.b.zhang@intel.com>
Cc: Jiewen Yao <jiewen.yao@intel.com>
Cc: Jian Wang <jian.j.wang@intel.com>
Modify only the following files in this patch:
SecurityPkg/Include/Library/HashLib.h
SecurityPkg/Library/HashInstanceLibSm3/HashInstanceLibSm3.c
SecurityPkg/Library/HashInstanceLibSm3/HashInstanceLibSm3.inf
SecurityPkg/Library/HashInstanceLibSm3/HashInstanceLibSm3.uni
SecurityPkg/SecurityPkg.dsc
(2c) PATCH v2 3/5:
Subject:
SecurityPkg/HashLibBaseCryptoRouter: recognize the SM3 digest algorithm
Package maintainers to CC: see (2b)
Modify only the following files in this patch:
SecurityPkg/Library/HashLibBaseCryptoRouter/HashLibBaseCryptoRouterCommon.c
(2d) PATCH v2 4/5:
Subject:
SecurityPkg: set SM3 bit in TPM 2.0 hash mask by default
Package maintainers to CC: see (2b)
Modify only the following files in this patch:
SecurityPkg/SecurityPkg.dec
(2e) PATCH v2 5/5:
Subject:
OvmfPkg: link SM3 support into Tcg2Pei and Tcg2Dxe
Package maintainers to CC:
Cc: Jordan Justen <jordan.l.justen@intel.com>
Cc: Laszlo Ersek <lersek@redhat.com>
Cc: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Cc: Marc-André Lureau <marcandre.lureau@redhat.com>
Cc: Stefan Berger <stefanb@linux.ibm.com>
Modify only the following files in this patch:
OvmfPkg/OvmfPkgIa32.dsc
OvmfPkg/OvmfPkgIa32X64.dsc
OvmfPkg/OvmfPkgX64.dsc
(3) Now, let's see what the series actually does.
(3a) For modifying a protocol include header under MdePkg, you first
need to go through the standardization process with the USWG. Once a
UEFI spec version has been released with the new feature, you can submit
the patches. Until then, you can implement such API changes only under
"MdeModulePkg/Include/Protocol", as an edk2 extension. The MdePkg
maintainers can explain in more detail.
(3b) You extend the "mTpm2HashMask" array with SM3 in
"HashLibBaseCryptoRouter". But such an array exists in "HashLibTpm2" as
well. The SecurityPkg maintainers can advise you on keeping these in
sync. It is likely that you will need to add yet another patch,
similarly to (2c) above.
(3c) This comment is akin to (3a). The documentation on
"PcdTpm2HashMask" in "SecurityPkg.dec" says, "Bit definition strictly
follows TCG Algorithm Registry". Therefore, in patch (2d), you need to
show that the TCG Algorithm Registry includes the SM3 hash algorithm
(link to released TCG PDF).
For now, I would normally suggest that you please submit a v2 with only
these structural and formal fixes, so that MdePkg and SecurityPkg
maintainers can comment on your work at all. Right now the patch series
is poorly structured, which makes it hard for package maintainers to
determine their review jurisdictions, and to make comments on the
semantics. Luckily, this aspect can be improved quite easily -- just
rearrange the files between the patches (see above), write to-the-point
subject lines, and good commit messages.
... However: in the cover letter, you mention that SM3 depends on
OpenSSL-1.1.1b. That work has not been merged into edk2 yet. So I
suggest holding the present series in your private tree, until
OpenSSL-1.1.1b is upstreamed.
(Other package maintainers may disagree of course, if they prefer to
review this work in parallel!)
Thanks
Laszlo
^ permalink raw reply [flat|nested] 9+ messages in thread* Re: [edk2-devel] [Enable measured boot with SM3 digest algorithm 0/4]
2019-05-17 18:31 [Enable measured boot with SM3 digest algorithm 0/4] Imran Desai
` (4 preceding siblings ...)
2019-05-20 16:23 ` [edk2-devel] [Enable measured boot with SM3 digest algorithm 0/4] Laszlo Ersek
@ 2019-05-20 16:30 ` Yao, Jiewen
2019-05-21 16:58 ` Desai, Imran
5 siblings, 1 reply; 9+ messages in thread
From: Yao, Jiewen @ 2019-05-20 16:30 UTC (permalink / raw)
To: devel@edk2.groups.io, Desai, Imran
hi
thanks for this contribution
Besides the comment from Laszlo, would you please also share your unit test result?
What test you have done for this patch?
thank you!
Yao, Jiewen
> 在 2019年5月17日，下午2:43，Imran Desai <imran.desai@intel.com> 写道：
>
> https://github.com/idesai/edk2/tree/enable_sm3_measured_boot
>
> Support for SM3 digest algorithm is needed for TPM with SM3 PCR banks. This digest algorithm is part of the China Crypto algorithm suite. Support for these algorithms is needed to enable platforms for the PRC market.
> This integration has dependency on the openssl_1_1_1b integration into edk2.
>
> Imran Desai (4):
> sm3_enabling: Augment crypt interface with calls into openssl to
> calculate sm3 digest prior to exercising TPM2 calls for PCR extend
> sm3-enabling: Add SM3 TCG algorithm registry value to the
> PcdTpm2HashMask
> sm3-enabling: Add SM3 guid reference in the TPM2 hash mask structure
> in HashLibBaseCryptoRouterCommon.c
> sm3-enabling: Add SM3 hashinstance library information to all OvmfPkg
> and SecurityPkg
>
> SecurityPkg/SecurityPkg.dec | 5 +-
> OvmfPkg/OvmfPkgIa32.dsc | 2 +
> OvmfPkg/OvmfPkgIa32X64.dsc | 2 +
> OvmfPkg/OvmfPkgX64.dsc | 2 +
> SecurityPkg/SecurityPkg.dsc | 3 +
> .../HashInstanceLibSm3/HashInstanceLibSm3.inf | 46 ++++++
> MdePkg/Include/Protocol/Hash.h | 5 +
> SecurityPkg/Include/Library/HashLib.h | 1 +
> .../HashInstanceLibSm3/HashInstanceLibSm3.c | 155 ++++++++++++++++++
> .../HashLibBaseCryptoRouterCommon.c | 1 +
> .../HashInstanceLibSm3/HashInstanceLibSm3.uni | 21 +++
> 11 files changed, 241 insertions(+), 2 deletions(-)
> create mode 100644 SecurityPkg/Library/HashInstanceLibSm3/HashInstanceLibSm3.inf
> create mode 100644 SecurityPkg/Library/HashInstanceLibSm3/HashInstanceLibSm3.c
> create mode 100644 SecurityPkg/Library/HashInstanceLibSm3/HashInstanceLibSm3.uni
>
> --
> 2.17.0
>
>
>
>
^ permalink raw reply [flat|nested] 9+ messages in thread* Re: [edk2-devel] [Enable measured boot with SM3 digest algorithm 0/4]
2019-05-20 16:30 ` Yao, Jiewen
@ 2019-05-21 16:58 ` Desai, Imran
2019-05-21 17:01 ` Yao, Jiewen
0 siblings, 1 reply; 9+ messages in thread
From: Desai, Imran @ 2019-05-21 16:58 UTC (permalink / raw)
To: Yao, Jiewen, devel@edk2.groups.io
Hello Jiewen,
I tested SM3 PCR extensions on the OvmfPkg using swTPM (and TPM2 simulator).
The validation was done comparing PCR extensions from the TCG2 EventLog and SM3 PCR Bank data from the simulator at every extension.
Additionally each SM3 extension and resulting values were compared and contrasted against OpenSSL_1_1_1b on a linux dev machine to ensure the accuracy of the digest values being produced, extended and realized as a final value in the PCR.
Thanks and Regards,
Imran Desai
________________________________________
From: Yao, Jiewen
Sent: Monday, May 20, 2019 9:30 AM
To: devel@edk2.groups.io; Desai, Imran
Subject: Re: [edk2-devel] [Enable measured boot with SM3 digest algorithm 0/4]
hi
thanks for this contribution
Besides the comment from Laszlo, would you please also share your unit test result?
What test you have done for this patch?
thank you!
Yao, Jiewen
> 在 2019年5月17日，下午2:43，Imran Desai <imran.desai@intel.com> 写道：
>
> https://github.com/idesai/edk2/tree/enable_sm3_measured_boot
>
> Support for SM3 digest algorithm is needed for TPM with SM3 PCR banks. This digest algorithm is part of the China Crypto algorithm suite. Support for these algorithms is needed to enable platforms for the PRC market.
> This integration has dependency on the openssl_1_1_1b integration into edk2.
>
> Imran Desai (4):
> sm3_enabling: Augment crypt interface with calls into openssl to
> calculate sm3 digest prior to exercising TPM2 calls for PCR extend
> sm3-enabling: Add SM3 TCG algorithm registry value to the
> PcdTpm2HashMask
> sm3-enabling: Add SM3 guid reference in the TPM2 hash mask structure
> in HashLibBaseCryptoRouterCommon.c
> sm3-enabling: Add SM3 hashinstance library information to all OvmfPkg
> and SecurityPkg
>
> SecurityPkg/SecurityPkg.dec | 5 +-
> OvmfPkg/OvmfPkgIa32.dsc | 2 +
> OvmfPkg/OvmfPkgIa32X64.dsc | 2 +
> OvmfPkg/OvmfPkgX64.dsc | 2 +
> SecurityPkg/SecurityPkg.dsc | 3 +
> .../HashInstanceLibSm3/HashInstanceLibSm3.inf | 46 ++++++
> MdePkg/Include/Protocol/Hash.h | 5 +
> SecurityPkg/Include/Library/HashLib.h | 1 +
> .../HashInstanceLibSm3/HashInstanceLibSm3.c | 155 ++++++++++++++++++
> .../HashLibBaseCryptoRouterCommon.c | 1 +
> .../HashInstanceLibSm3/HashInstanceLibSm3.uni | 21 +++
> 11 files changed, 241 insertions(+), 2 deletions(-)
> create mode 100644 SecurityPkg/Library/HashInstanceLibSm3/HashInstanceLibSm3.inf
> create mode 100644 SecurityPkg/Library/HashInstanceLibSm3/HashInstanceLibSm3.c
> create mode 100644 SecurityPkg/Library/HashInstanceLibSm3/HashInstanceLibSm3.uni
>
> --
> 2.17.0
>
>
>
>
^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: [edk2-devel] [Enable measured boot with SM3 digest algorithm 0/4]
2019-05-21 16:58 ` Desai, Imran
@ 2019-05-21 17:01 ` Yao, Jiewen
0 siblings, 0 replies; 9+ messages in thread
From: Yao, Jiewen @ 2019-05-21 17:01 UTC (permalink / raw)
To: Desai, Imran; +Cc: devel@edk2.groups.io
Cool Thanks
thank you!
Yao, Jiewen
> 在 2019年5月21日，上午9:58，Desai, Imran <imran.desai@intel.com> 写道：
>
> Hello Jiewen,
>
> I tested SM3 PCR extensions on the OvmfPkg using swTPM (and TPM2 simulator).
> The validation was done comparing PCR extensions from the TCG2 EventLog and SM3 PCR Bank data from the simulator at every extension.
> Additionally each SM3 extension and resulting values were compared and contrasted against OpenSSL_1_1_1b on a linux dev machine to ensure the accuracy of the digest values being produced, extended and realized as a final value in the PCR.
>
> Thanks and Regards,
>
> Imran Desai
> ________________________________________
> From: Yao, Jiewen
> Sent: Monday, May 20, 2019 9:30 AM
> To: devel@edk2.groups.io; Desai, Imran
> Subject: Re: [edk2-devel] [Enable measured boot with SM3 digest algorithm 0/4]
>
> hi
> thanks for this contribution
> Besides the comment from Laszlo, would you please also share your unit test result?
> What test you have done for this patch?
>
> thank you!
> Yao, Jiewen
>
>
>> 在 2019年5月17日，下午2:43，Imran Desai <imran.desai@intel.com> 写道：
>>
>> https://github.com/idesai/edk2/tree/enable_sm3_measured_boot
>>
>> Support for SM3 digest algorithm is needed for TPM with SM3 PCR banks. This digest algorithm is part of the China Crypto algorithm suite. Support for these algorithms is needed to enable platforms for the PRC market.
>> This integration has dependency on the openssl_1_1_1b integration into edk2.
>>
>> Imran Desai (4):
>> sm3_enabling: Augment crypt interface with calls into openssl to
>> calculate sm3 digest prior to exercising TPM2 calls for PCR extend
>> sm3-enabling: Add SM3 TCG algorithm registry value to the
>> PcdTpm2HashMask
>> sm3-enabling: Add SM3 guid reference in the TPM2 hash mask structure
>> in HashLibBaseCryptoRouterCommon.c
>> sm3-enabling: Add SM3 hashinstance library information to all OvmfPkg
>> and SecurityPkg
>>
>> SecurityPkg/SecurityPkg.dec | 5 +-
>> OvmfPkg/OvmfPkgIa32.dsc | 2 +
>> OvmfPkg/OvmfPkgIa32X64.dsc | 2 +
>> OvmfPkg/OvmfPkgX64.dsc | 2 +
>> SecurityPkg/SecurityPkg.dsc | 3 +
>> .../HashInstanceLibSm3/HashInstanceLibSm3.inf | 46 ++++++
>> MdePkg/Include/Protocol/Hash.h | 5 +
>> SecurityPkg/Include/Library/HashLib.h | 1 +
>> .../HashInstanceLibSm3/HashInstanceLibSm3.c | 155 ++++++++++++++++++
>> .../HashLibBaseCryptoRouterCommon.c | 1 +
>> .../HashInstanceLibSm3/HashInstanceLibSm3.uni | 21 +++
>> 11 files changed, 241 insertions(+), 2 deletions(-)
>> create mode 100644 SecurityPkg/Library/HashInstanceLibSm3/HashInstanceLibSm3.inf
>> create mode 100644 SecurityPkg/Library/HashInstanceLibSm3/HashInstanceLibSm3.c
>> create mode 100644 SecurityPkg/Library/HashInstanceLibSm3/HashInstanceLibSm3.uni
>>
>> --
>> 2.17.0
>>
>>
>>
>>
^ permalink raw reply [flat|nested] 9+ messages in thread