Re: [edk2-devel] [PATCH V3 00/12] Disable the deprecated MD5 and SHA1 support

["Yao, Jiewen" <jiewen.yao@intel.com>]

For CryptoPkg and SecurityPkg, Reviewed-by: Jiewen Yao <Jiewen.yao@intel.com>

> -----Original Message-----
> From: devel@edk2.groups.io <devel@edk2.groups.io> On Behalf Of
> gaoliming
> Sent: Friday, November 13, 2020 2:25 PM
> To: devel@edk2.groups.io; Gao, Zhichao <zhichao.gao@intel.com>
> Cc: Justen, Jordan L <jordan.l.justen@intel.com>; 'Laszlo Ersek'
> <lersek@redhat.com>; 'Ard Biesheuvel' <ard.biesheuvel@arm.com>; 'Sami
> Mujawar' <sami.mujawar@arm.com>; 'Leif Lindholm' <leif@nuviainc.com>;
> Yao, Jiewen <jiewen.yao@intel.com>; Wang, Jian J <jian.j.wang@intel.com>;
> Lu, XiaoyuX <xiaoyux.lu@intel.com>; Jiang, Guomin
> <guomin.jiang@intel.com>; Kinney, Michael D
> <michael.d.kinney@intel.com>; Steele, Kelly <kelly.steele@intel.com>; Sun,
> Zailiang <zailiang.sun@intel.com>; Qian, Yi <yi.qian@intel.com>; 'Maciej
> Rabeda' <maciej.rabeda@linux.intel.com>; Wu, Jiaxin <jiaxin.wu@intel.com>;
> Fu, Siyuan <siyuan.fu@intel.com>; Feng, Roger <roger.feng@intel.com>; Liu,
> Zhiguang <zhiguang.liu@intel.com>
> Subject: 回复: [edk2-devel] [PATCH V3 00/12] Disable the deprecated MD5
> and SHA1 support
> 
> Zhichao:
>   I see the latest V4 version have been sent. Few days may be required for
> code review.
> 
> Hi, NetworkPkg, CryptoPkg, OvmfPkg, ArmVirtPkg package maintainer and
> reviewer:
>   Because stable tag 202011 is coming soon, can you finish the code review
> for this patch set (V4 version) before Nov 17 (Next Tuesday)?
> 
> Thanks
> Liming
> > -----邮件原件-----
> > 发件人: bounce+27952+67411+4905953+8761045@groups.io
> > <bounce+27952+67411+4905953+8761045@groups.io> 代表 Gao, Zhichao
> > 发送时间: 2020年11月13日 9:08
> > 收件人: devel@edk2.groups.io; Gao, Zhichao <zhichao.gao@intel.com>
> > 抄送: Justen, Jordan L <jordan.l.justen@intel.com>; Laszlo Ersek
> > <lersek@redhat.com>; Ard Biesheuvel <ard.biesheuvel@arm.com>; Sami
> > Mujawar <sami.mujawar@arm.com>; Leif Lindholm <leif@nuviainc.com>;
> > Yao, Jiewen <jiewen.yao@intel.com>; Wang, Jian J
> <jian.j.wang@intel.com>;
> > Lu, XiaoyuX <xiaoyux.lu@intel.com>; Jiang, Guomin
> > <guomin.jiang@intel.com>; Kinney, Michael D
> <michael.d.kinney@intel.com>;
> > Steele, Kelly <kelly.steele@intel.com>; Sun, Zailiang <zailiang.sun@intel.
> com>;
> > Qian, Yi <yi.qian@intel.com>; Liming Gao <gaoliming@byosoft.com.cn>;
> > Maciej Rabeda <maciej.rabeda@linux.intel.com>; Wu, Jiaxin
> > <jiaxin.wu@intel.com>; Fu, Siyuan <siyuan.fu@intel.com>; Feng, Roger
> > <roger.feng@intel.com>; Liu, Zhiguang <zhiguang.liu@intel.com>
> > 主题: Re: [edk2-devel] [PATCH V3 00/12] Disable the deprecated MD5 and
> > SHA1 support
> >
> > I plan to catch the 202011 stable tag for this patch set. Please help to
> review
> > this patch. I would like to request to extend time for review after
> feature
> > freeze.
> > Make the default setting for security and let the user of edk2 aware of it
> if
> > they are using unsecure functions make sense.
> > If you have any doubt or comment, please feel free to let me know.
> >
> > Thanks,
> > Zhichao
> >
> > > -----Original Message-----
> > > From: devel@edk2.groups.io <devel@edk2.groups.io> On Behalf Of Gao,
> > Zhichao
> > > Sent: Wednesday, November 11, 2020 1:37 AM
> > > To: devel@edk2.groups.io
> > > Cc: Justen, Jordan L <jordan.l.justen@intel.com>; Laszlo Ersek
> > > <lersek@redhat.com>; Ard Biesheuvel <ard.biesheuvel@arm.com>; Sami
> > > Mujawar <sami.mujawar@arm.com>; Leif Lindholm <leif@nuviainc.com>;
> > Yao,
> > > Jiewen <jiewen.yao@intel.com>; Wang, Jian J <jian.j.wang@intel.com>;
> Lu,
> > > XiaoyuX <xiaoyux.lu@intel.com>; Jiang, Guomin
> <guomin.jiang@intel.com>;
> > > Kinney, Michael D <michael.d.kinney@intel.com>; Steele, Kelly
> > > <kelly.steele@intel.com>; Sun, Zailiang <zailiang.sun@intel.com>; Qian,
> Yi
> > > <yi.qian@intel.com>; Liming Gao <gaoliming@byosoft.com.cn>; Maciej
> > Rabeda
> > > <maciej.rabeda@linux.intel.com>; Wu, Jiaxin <jiaxin.wu@intel.com>; Fu,
> > Siyuan
> > > <siyuan.fu@intel.com>; Feng, Roger <roger.feng@intel.com>; Liu,
> Zhiguang
> > > <zhiguang.liu@intel.com>
> > > Subject: [edk2-devel] [PATCH V3 00/12] Disable the deprecated MD5 and
> > SHA1
> > > support
> > >
> > > REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3003
> > > REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3021
> > > REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3027
> > >
> > > MD5 is deprecated, make it disable as default for security.
> > > It required to set MD5 enable explicitly if the module is still using
> MD5. List
> > the
> > > modules that are still using it:
> > > iSCSI, Hash2DxeCrypto, CryptoDxe(Pei, Smm) (with PACKAGE or ALL
> config).
> > >
> > > This patch set would affact the platforms that are using iSCSI function.
> > >
> > > V2:
> > > Remove MD5 and SHA1 support of Hash2DxeCrypto.
> > > Remove the MD5 GUID defination in MdePkg.dec. SHA1 related GUIDs
> are
> > still
> > > using in TPM2, so keep them.
> > > No requirement to add MD5 enable MACRO in SecurityPkg.
> > >
> > > V3:
> > > Explicitly enable iSCSI for ArmVirtQemu, ArmVirtQemuKernel,
> OvmfPkgIa32,
> > > OvmfPkgIa32X64, OvmfPkgX64 and BhyveX64.
> > > And set the MD5 enable base on the new MD5 MACRO.
> > > Rejust the patch order.
> > >
> > > Cc: Jordan Justen <jordan.l.justen@intel.com>
> > > Cc: Laszlo Ersek <lersek@redhat.com>
> > > Cc: Ard Biesheuvel <ard.biesheuvel@arm.com>
> > > Cc: Sami Mujawar <sami.mujawar@arm.com>
> > > Cc: Leif Lindholm <leif@nuviainc.com>
> > > Cc: Jiewen Yao <jiewen.yao@intel.com>
> > > Cc: Jian J Wang <jian.j.wang@intel.com>
> > > Cc: Xiaoyu Lu <xiaoyux.lu@intel.com>
> > > Cc: Guomin Jiang <guomin.jiang@intel.com>
> > > Cc: Michael D Kinney <michael.d.kinney@intel.com>
> > > Cc: Kelly Steele <kelly.steele@intel.com>
> > > Cc: Zailiang Sun <zailiang.sun@intel.com>
> > > Cc: Yi Qian <yi.qian@intel.com>
> > > Cc: Liming Gao <gaoliming@byosoft.com.cn>
> > > Cc: Maciej Rabeda <maciej.rabeda@linux.intel.com>
> > > Cc: Jiaxin Wu <jiaxin.wu@intel.com>
> > > Cc: Siyuan Fu <siyuan.fu@intel.com>
> > > Cc: Roger Feng <roger.feng@intel.com>
> > > Cc: Zhiguang Liu <zhiguang.liu@intel.com>
> > > Signed-off-by: Zhichao Gao <zhichao.gao@intel.com>
> > >
> > > Zhichao Gao (12):
> > >   SecurityPkg/Hash2DxeCrypto: Remove MD5 support
> > >   SecurityPkg/Hash2DxeCrypto: Remove SHA1 support
> > >   CryptoPkg/dsc: Enable MD5 when CRYPTO_SERVICES enable MD5
> > >   NetworkPkg: Enable MD5 while enable iSCSI
> > >   ArmVirtPkg/ArmVirtQemu.dsc: Enable MD5 while enable iSCSI
> > >   ArmVirtPkg/ArmVirtQemuKernel.dsc: Enable MD5 while enable iSCSI
> > >   OvmfPkg/OvmfPkgIa32.dsc: Enable MD5 while enable iSCSI
> > >   OvmfPkg/OvmfPkgIa32X64.dsc: Enable MD5 while enable iSCSI
> > >   OvmfPkg/OvmfPkgX64.dsc: Enable MD5 while enable iSCSI
> > >   OvmfPkg/BhyveX64.dsc: Enable MD5 while enable iSCSI
> > >   NetworkPkg/Defines: Make iSCSI disable as default
> > >   CryptoPkg: Make the MD5 disable as default for security
> > >
> > >  ArmVirtPkg/ArmVirtQemu.dsc                             | 8
> > +++++++-
> > >  ArmVirtPkg/ArmVirtQemuKernel.dsc                       | 8
> > +++++++-
> > >  CryptoPkg/CryptoPkg.dsc                                | 3 +++
> > >  CryptoPkg/Driver/Crypto.c                              | 4 ++--
> > >  CryptoPkg/Include/Library/BaseCryptLib.h               | 2 +-
> > >  CryptoPkg/Library/BaseCryptLib/Hash/CryptMd5.c         | 2 +-
> > >  CryptoPkg/Library/BaseCryptLibOnProtocolPpi/CryptLib.c | 2 +-
> > >  NetworkPkg/Network.dsc.inc                             | 5
> > +++++
> > >  NetworkPkg/NetworkDefines.dsc.inc                      | 4 ++--
> > >  OvmfPkg/Bhyve/BhyveX64.dsc                             | 7
> > ++++++-
> > >  OvmfPkg/OvmfPkgIa32.dsc                                | 5
> > +++++
> > >  OvmfPkg/OvmfPkgIa32X64.dsc                             | 5
> > +++++
> > >  OvmfPkg/OvmfPkgX64.dsc                                 | 5
> > +++++
> > >  SecurityPkg/Hash2DxeCrypto/Hash2DxeCrypto.c            | 2 --
> > >  SecurityPkg/Hash2DxeCrypto/Hash2DxeCrypto.inf          | 4 +---
> > >  15 files changed, 51 insertions(+), 15 deletions(-)
> > >
> > > --
> > > 2.21.0.windows.1
> > >
> > >
> > >
> > >
> > >
> >
> >
> >
> >
> >
> 
> 
> 
> 
> 
> 
>