From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-vs1-f52.google.com (mail-vs1-f52.google.com [209.85.217.52]) by mx.groups.io with SMTP id smtpd.web09.6022.1643369013104191216 for ; Fri, 28 Jan 2022 03:23:33 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20210112 header.b=MblDmI7t; spf=pass (domain: gmail.com, ip: 209.85.217.52, mailfrom: pedro.falcato@gmail.com) Received: by mail-vs1-f52.google.com with SMTP id g23so2580968vsf.7 for ; Fri, 28 Jan 2022 03:23:32 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=bhH5iPbg/aA7/B6a3h33cRWqlAy/pYseXJoOD8h1tQY=; b=MblDmI7tAzoUdc5JyXzr0jsnHBgysIl5EXGhKqT9ux1WqjYNTJO/W2OqSOtqxXv2KE ddXiB4zSxMgu2jWSw4C48kXw4mPpq0wHwGXYB/dLWMb0dOUHljqbJDlh4BCQ9F1JAgDd kuhRCTecyPFpfdIVQh4FU9dQzNOBbDK59cBm6A0IIdpHX8hw5RenqwmY3l/XPi7dy0+Z d33fGPO1EQcDIuuCiYKhmseaxEtn6oRdDchdW+Wn5GmOKVqW4fr0h71A0o1D2UCeK8+X 8E03GeQmHdhbOh1UJVjvrMQvciJEwwsr5h/bn41wPqxb+94LV3FpzKKohGl1TFF1uE4B 1aEw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=bhH5iPbg/aA7/B6a3h33cRWqlAy/pYseXJoOD8h1tQY=; b=OtJUHOXQ32wpjw+Dp+tos79bnUjvNT8teMeOWLz/15wn+iAuzlLzz41xBBQbqIG8kl n5fZKy0dc2t9b96nonYUjk2L78/ufA7u1VUMBhjplRzezuAwN+dr/UpfGLmx0zK4axi7 r4Mu+71PES6D4kA5ebWyc9uSfqYEKTcbXddjuqDbWV4xtY0xSodwAuakP8/ZHDqTvklF oAVepX2OpwJazrDuCeOfUB2fvsadUavtVy3m6yBRQ7BvE0Fj1mkY/dGvRpnbhPCdbxge P6+akLk3rR0JLzbTnoN8uQC3+Q05XHZniyPB7+nSjCTMGSNGEarf70sN1Vpt4WnwjoFD tU0g== X-Gm-Message-State: AOAM530O4WT2mNR4ljPpqtug8C14t+HhFfFCLf5RodaimfG4ory2KyRD mTc51zX42sg4Q3ssWawIORePxplu41ultPyUyh4= X-Google-Smtp-Source: ABdhPJypYUJ7iR0VwB9ImydWE93N37guX8F4qgNbC7Km0e0mjdZQx3cjT+8eLqifRdHW9sHBUmO18Nfg2iwWoY2TH9o= X-Received: by 2002:a67:6102:: with SMTP id v2mr3527840vsb.15.1643369012172; Fri, 28 Jan 2022 03:23:32 -0800 (PST) MIME-Version: 1.0 References: <20220121083035.dsqzu3akshonliza@sirius.home.kraxel.org> <20220126110244.klk24znojvdtirzw@sirius.home.kraxel.org> <71737233-2840-42CE-A65E-1895E936B4CB@apple.com> <20220128101429.s7sop6wz2ictnmuw@sirius.home.kraxel.org> In-Reply-To: <20220128101429.s7sop6wz2ictnmuw@sirius.home.kraxel.org> From: "Pedro Falcato" Date: Fri, 28 Jan 2022 11:23:21 +0000 Message-ID: Subject: Re: [edk2-devel] [PATCH 00/24] CryptoPkg/openssl: update openssl submodule to v3.0 To: "kraxel@redhat.com" Cc: edk2-devel-groups-io , Andrew Fish , "KILIAN_KEGEL@outlook.com" , Mike Kinney , "Yao, Jiewen" , Sean Brogan , Bret Barkelew , "Wang, Jian J" , "Jiang, Guomin" , Pawel Polawski , "Lu, XiaoyuX" Content-Type: multipart/alternative; boundary="000000000000349b2805d6a2aaf6" --000000000000349b2805d6a2aaf6 Content-Type: text/plain; charset="UTF-8" Just to clarify, I understand *why* we need crypto, I just don't understand why we're pulling such a huge library instead of picking something smaller or cutting down OpenSSL (or Libre/Boring, which seem a good bit smaller than the original OpenSSL). While typing this I also found mbed TLS which seems to be part-maintained by ARM and explicitly handles all 64-bit division cases. I think limiting all EFI code imports to smaller libraries that were designed with embedded in mind would both solve our issues and would be a better technical solution. Thanks, Pedro On Fri, Jan 28, 2022 at 10:14 AM kraxel@redhat.com wrote: > Hi, > > > I think that maybe "Why are we bringing in so much third-party code to > > firmware?" is a way better question than "is it feasible to implement all > > the required builtins?". Why can my firmware speak TLS, and why does it > > have a whole copy of *OpenSSL*, which is a huge library with a big attack > > surface and was never written to be run in a firmware/kernel/bare metal > > environment like UEFI. > > crypto is needed for: > (1) network boot (tls for https) > (2) iscsi (tls too). > (3) secure boot. > (4) tpm support. > (5) secure firmware updates. > > And possibly more. > > > Note: If there's a big need for something like internal TLS I would > > recommend BearSSL as a very small TLS implementation that was actually > > written for embedded systems. > > Well, that doesn't look like an actively maintained project. One commit > in 2021. Four commits in 2020. Features like TLS-1.3 support on the > TODO-List but apparently nobody working on it. > > take care, > Gerd > > -- Pedro Falcato --000000000000349b2805d6a2aaf6 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Just to clarify, I understand *why* we need crypto, I just= don't understand why we're pulling such a huge library instead of = picking something smaller or cutting down OpenSSL (or Libre/Boring, which s= eem=C2=A0a good bit smaller than the original OpenSSL).

While typin= g this I also found mbed TLS which seems to be part-maintained by ARM and e= xplicitly handles all 64-bit division cases.

I thi= nk limiting all EFI code imports to smaller libraries that were designed wi= th embedded in mind would both solve our issues and would be a better techn= ical solution.

Thanks,
Pedro

On Fri, Jan 2= 8, 2022 at 10:14 AM kraxel@redhat.com<= /a> <kraxel@redhat.com> wrot= e:
=C2=A0 Hi,
> I think that maybe "Why are we bringing in so much third-party co= de to
> firmware?" is a way better question than "is it feasible to = implement all
> the required builtins?". Why can my firmware speak TLS, and why d= oes it
> have a whole copy of *OpenSSL*, which is a huge library with a big att= ack
> surface and was never written to be run in a firmware/kernel/bare meta= l
> environment like UEFI.

crypto is needed for:
=C2=A0 (1) network boot (tls for https)
=C2=A0 (2) iscsi (tls too).
=C2=A0 (3) secure boot.
=C2=A0 (4) tpm support.
=C2=A0 (5) secure firmware updates.

And possibly more.

> Note: If there's a big need for something like internal TLS I woul= d
> recommend BearSSL as a very small TLS implementation that was actually=
> written for embedded systems.

Well, that doesn't look like an actively maintained project.=C2=A0 One = commit
in 2021.=C2=A0 Four commits in 2020.=C2=A0 Features like TLS-1.3 support on= the
TODO-List but apparently nobody working on it.

take care,
=C2=A0 Gerd



--
Pedro Falcato
--000000000000349b2805d6a2aaf6--