From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail05.groups.io (mail05.groups.io [45.79.224.7]) by spool.mail.gandi.net (Postfix) with ESMTPS id D6E67941CA3 for ; Wed, 8 May 2024 16:58:31 +0000 (UTC) DKIM-Signature: a=rsa-sha256; bh=2EjOwAFAdF7nKmFItIJfiztbUM9xMb1sv47aFpX9oiE=; c=relaxed/simple; d=groups.io; h=MIME-Version:References:In-Reply-To:From:Date:Message-ID:Subject:To:Precedence:List-Subscribe:List-Help:Sender:List-Id:Mailing-List:Delivered-To:Resent-Date:Resent-From:Reply-To:List-Unsubscribe-Post:List-Unsubscribe:Content-Type; s=20240206; t=1715187510; v=1; b=OHZZXptxLhd5DSN4SVFf9kxMK/YsXj0kZhHjWmofhLntZ967WEyNmaxPpZNJht/XBZOR+xQh ZGrftUUv5uO39bSzRnvsFlweGI7qQMftHV6COspePfzk6xGEoBHPCNjfDHzfH+mlSCW/cWicOZp sP0BTK362w4/2Zn12vTfiGDSYusAxuEsXkBE3ADiXOxsmHkEbf03qUOaj1mKYaIMo5rY1lnzaRy JCw1TfFHBNocFARb0d4s0QONTZv73lZbKi06pnrSUXAx10sDOGyJo1oMeFPjDTamLMKKkTF86nl 8siedMXaMqspryVkDJ0W8mG0826qdveFdaAOhAYvgkdQw== X-Received: by 127.0.0.2 with SMTP id wXkgYY7687511xx7WudgyySg; Wed, 08 May 2024 09:58:30 -0700 X-Received: from sin.source.kernel.org (sin.source.kernel.org [145.40.73.55]) by mx.groups.io with SMTP id smtpd.web10.2255.1715187509168604257 for ; Wed, 08 May 2024 09:58:29 -0700 X-Received: from smtp.kernel.org (transwarp.subspace.kernel.org [100.75.92.58]) by sin.source.kernel.org (Postfix) with ESMTP id 61DA5CE19D9 for ; Wed, 8 May 2024 16:58:26 +0000 (UTC) X-Received: by smtp.kernel.org (Postfix) with ESMTPSA id 9C4BBC32781 for ; Wed, 8 May 2024 16:58:25 +0000 (UTC) X-Received: by mail-lf1-f53.google.com with SMTP id 2adb3069b0e04-51f29e80800so4960097e87.2 for ; Wed, 08 May 2024 09:58:25 -0700 (PDT) X-Gm-Message-State: uhMxPt6lsB1qnzvb515cywvJx7686176AA= X-Google-Smtp-Source: AGHT+IG5Phve1QAO7IEYWYv70KNlPEFGIpTNVJ/AN+L5C73OF8bgDpfm7D+zpUgXrBBmxEhhUZh1Qag24RyOfE7aVFo= X-Received: by 2002:a19:e047:0:b0:521:b3a1:33e8 with SMTP id 2adb3069b0e04-521b3a1341bmr1162512e87.67.1715187503857; Wed, 08 May 2024 09:58:23 -0700 (PDT) MIME-Version: 1.0 References: <1400.1715186826863822852@groups.io> In-Reply-To: <1400.1715186826863822852@groups.io> From: "Ard Biesheuvel" Date: Wed, 8 May 2024 18:58:12 +0200 X-Gmail-Original-Message-ID: Message-ID: Subject: Re: [edk2-devel] [PATCH v1 07/14] NetworkPkg:: SECURITY PATCH CVE-2023-45237 To: devel@edk2.groups.io, dougflick@microsoft.com Precedence: Bulk List-Subscribe: List-Help: Sender: devel@edk2.groups.io List-Id: Mailing-List: list devel@edk2.groups.io; contact devel+owner@edk2.groups.io Resent-Date: Wed, 08 May 2024 09:58:29 -0700 Resent-From: ardb@kernel.org Reply-To: devel@edk2.groups.io,ardb@kernel.org List-Unsubscribe-Post: List-Unsubscribe=One-Click List-Unsubscribe: Content-Type: text/plain; charset="UTF-8" X-GND-Status: LEGIT Authentication-Results: spool.mail.gandi.net; dkim=pass header.d=groups.io header.s=20240206 header.b=OHZZXptx; dmarc=fail reason="SPF not aligned (relaxed), DKIM not aligned (relaxed)" header.from=kernel.org (policy=none); spf=pass (spool.mail.gandi.net: domain of bounce@groups.io designates 45.79.224.7 as permitted sender) smtp.mailfrom=bounce@groups.io On Wed, 8 May 2024 at 18:47, Doug Flick via groups.io wrote: > > I don't disagree. > > The intent is not to be limited by NIST specified standards but rather the only UEFI Spec defined algorithms are NIST Standards. > > https://uefi.org/specs/UEFI/2.10/37_Secure_Technologies.html#efi-rng-algorithm-definitions > > I'm not sure what's the best way to clarify this distinction > The issue here is that virtio-rng only exposes the 'raw' RNG protocol, which is what the underlying hardware claims to implement. This has a special status in the spec, as it can be used as an entropy source for the NIST algorithms, the security strength of which is cannot exceed the security strength represented by the size of the seed consumed from the raw input. So in that sense, it might be appropriate to treat the raw protocol in the same way as the NIST ones, and permit them, call them 'secure' etc. Only when taking the default (ergo unspecified) algorithm should we conclude that the algorithm may be less strong than what the spec requires. What would help is if RngDxe could wrap an implementation of the raw RNG protocol produced by another driver, and produce the NIST DRBGs based on that - perhaps I should look into that. -=-=-=-=-=-=-=-=-=-=-=- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#118699): https://edk2.groups.io/g/devel/message/118699 Mute This Topic: https://groups.io/mt/105983246/7686176 Group Owner: devel+owner@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [rebecca@openfw.io] -=-=-=-=-=-=-=-=-=-=-=-