From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: mx.groups.io; dkim=missing; spf=pass (domain: intel.com, ip: 192.55.52.88, mailfrom: jian.j.wang@intel.com) Received: from mga01.intel.com (mga01.intel.com [192.55.52.88]) by groups.io with SMTP; Mon, 22 Jul 2019 22:17:07 -0700 X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False Received: from fmsmga004.fm.intel.com ([10.253.24.48]) by fmsmga101.fm.intel.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 22 Jul 2019 22:17:06 -0700 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.64,297,1559545200"; d="scan'208";a="192950747" Received: from fmsmsx105.amr.corp.intel.com ([10.18.124.203]) by fmsmga004.fm.intel.com with ESMTP; 22 Jul 2019 22:17:07 -0700 Received: from fmsmsx603.amr.corp.intel.com (10.18.126.83) by FMSMSX105.amr.corp.intel.com (10.18.124.203) with Microsoft SMTP Server (TLS) id 14.3.439.0; Mon, 22 Jul 2019 22:17:06 -0700 Received: from fmsmsx603.amr.corp.intel.com (10.18.126.83) by fmsmsx603.amr.corp.intel.com (10.18.126.83) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.1713.5; Mon, 22 Jul 2019 22:17:06 -0700 Received: from shsmsx154.ccr.corp.intel.com (10.239.6.54) by fmsmsx603.amr.corp.intel.com (10.18.126.83) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256) id 15.1.1713.5 via Frontend Transport; Mon, 22 Jul 2019 22:17:06 -0700 Received: from shsmsx107.ccr.corp.intel.com ([169.254.9.162]) by SHSMSX154.ccr.corp.intel.com ([169.254.7.240]) with mapi id 14.03.0439.000; Tue, 23 Jul 2019 13:17:04 +0800 From: "Wang, Jian J" To: "West, Gary" , "devel@edk2.groups.io" CC: "Ye, Ting" Subject: Re: [PATCH 1/1] CryptoPkg/BaseCryptLib: Wrap OpenSSL HKDF algorithm Thread-Topic: [PATCH 1/1] CryptoPkg/BaseCryptLib: Wrap OpenSSL HKDF algorithm Thread-Index: AQHVQLqec0/XvQfKYke6RgWS4wwSPabXgSXggAAob2A= Date: Tue, 23 Jul 2019 05:17:03 +0000 Message-ID: References: Accept-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-titus-metadata-40: eyJDYXRlZ29yeUxhYmVscyI6IiIsIk1ldGFkYXRhIjp7Im5zIjoiaHR0cDpcL1wvd3d3LnRpdHVzLmNvbVwvbnNcL0ludGVsMyIsImlkIjoiZTkxMWY5MzktNGRkNi00NmRmLTg3NzEtYjYxNGUxODMwOGQ4IiwicHJvcHMiOlt7Im4iOiJDVFBDbGFzc2lmaWNhdGlvbiIsInZhbHMiOlt7InZhbHVlIjoiQ1RQX05UIn1dfV19LCJTdWJqZWN0TGFiZWxzIjpbXSwiVE1DVmVyc2lvbiI6IjE3LjEwLjE4MDQuNDkiLCJUcnVzdGVkTGFiZWxIYXNoIjoiMlhHOTJxcWdKSGMxbWNYK2lrUENMTXJhSWdVaG1cL3NwWkErWnhycmV1ZnlGaVZ6UGI2MWplakR4M0x6QVRJelYifQ== x-ctpclassification: CTP_NT dlp-product: dlpe-windows dlp-version: 11.0.600.7 dlp-reaction: no-action x-originating-ip: [10.239.127.40] MIME-Version: 1.0 Return-Path: jian.j.wang@intel.com Content-Language: en-US Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Gary, Mailing list edk2-devel@lists.01.org is not used any more. Please subscribe= and send review emails to devel@edk2.groups.io Regards, Jian > -----Original Message----- > From: Wang, Jian J > Sent: Tuesday, July 23, 2019 12:53 PM > To: West, Gary ; edk2-devel@lists.01.org > Cc: Ye, Ting > Subject: RE: [PATCH 1/1] CryptoPkg/BaseCryptLib: Wrap OpenSSL HKDF > algorithm >=20 > Gary, >=20 > (see my embedded comment below) >=20 > > -----Original Message----- > > From: West, Gary > > Sent: Tuesday, July 23, 2019 2:23 AM > > To: edk2-devel@lists.01.org > > Cc: West, Gary ; West, Gary > ; > > Wang, Jian J ; Ye, Ting > > Subject: [PATCH 1/1] CryptoPkg/BaseCryptLib: Wrap OpenSSL HKDF > > algorithm > > > > REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3D1928 > > > > 1. Implement OpenSSL HKDF wrapped function in CryptHkdf.c file. > > 2. Implement stub implementation function in CryptHkdfNull.c file. > > 3. Add wrapped HKDF function declaration to BaseCryptLib.h file. > > 4. Add CryptHkdf.c to module information BaseCryptLib.inf file. > > 5. Add CryptHkdfNull.c to module information PeiCryptLib.inf, > > RuntimeCryptLib.inf and SmmCryptLib.inf > > > > Signed-off-by: Gary West > > Cc: Jian Wang > > Cc: Ting Ye > > --- > > .../Library/BaseCryptLib/BaseCryptLib.inf | 1 + > > .../Library/BaseCryptLib/PeiCryptLib.inf | 4 +- > > .../Library/BaseCryptLib/RuntimeCryptLib.inf | 1 + > > .../Library/BaseCryptLib/SmmCryptLib.inf | 1 + > > CryptoPkg/Include/Library/BaseCryptLib.h | 33 ++++++++ > > .../Library/BaseCryptLib/Kdf/CryptHkdf.c | 80 +++++++++++++++++++ > > .../Library/BaseCryptLib/Kdf/CryptHkdfNull.c | 43 ++++++++++ > > 7 files changed, 160 insertions(+), 3 deletions(-) > > create mode 100644 CryptoPkg/Library/BaseCryptLib/Kdf/CryptHkdf.c > > create mode 100644 > CryptoPkg/Library/BaseCryptLib/Kdf/CryptHkdfNull.c > > > > diff --git a/CryptoPkg/Library/BaseCryptLib/BaseCryptLib.inf > > b/CryptoPkg/Library/BaseCryptLib/BaseCryptLib.inf > > index 020df3c19b3c..8d4988e8c6b4 100644 > > --- a/CryptoPkg/Library/BaseCryptLib/BaseCryptLib.inf > > +++ b/CryptoPkg/Library/BaseCryptLib/BaseCryptLib.inf > > @@ -37,6 +37,7 @@ [Sources] > > Hmac/CryptHmacMd5.c > > Hmac/CryptHmacSha1.c > > Hmac/CryptHmacSha256.c > > + Kdf/CryptHkdf.c > > Cipher/CryptAes.c > > Cipher/CryptTdes.c > > Cipher/CryptArc4.c > > diff --git a/CryptoPkg/Library/BaseCryptLib/PeiCryptLib.inf > > b/CryptoPkg/Library/BaseCryptLib/PeiCryptLib.inf > > index 4c4353747622..d26161d79ae5 100644 > > --- a/CryptoPkg/Library/BaseCryptLib/PeiCryptLib.inf > > +++ b/CryptoPkg/Library/BaseCryptLib/PeiCryptLib.inf > > @@ -43,10 +43,10 @@ [Sources] > > Hmac/CryptHmacMd5Null.c > > Hmac/CryptHmacSha1Null.c > > Hmac/CryptHmacSha256Null.c > > + Kdf/CryptHkdfNull.c > > Cipher/CryptAesNull.c > > Cipher/CryptTdesNull.c > > Cipher/CryptArc4Null.c > > - > > Pk/CryptRsaBasic.c > > Pk/CryptRsaExtNull.c > > Pk/CryptPkcs1OaepNull.c > > @@ -55,13 +55,11 @@ [Sources] > > Pk/CryptPkcs7VerifyCommon.c > > Pk/CryptPkcs7VerifyBase.c > > Pk/CryptPkcs7VerifyEku.c > > - > > Pk/CryptDhNull.c > > Pk/CryptX509Null.c > > Pk/CryptAuthenticodeNull.c > > Pk/CryptTsNull.c > > Pem/CryptPemNull.c > > - > > Rand/CryptRandNull.c > > > > SysCall/CrtWrapper.c > > diff --git a/CryptoPkg/Library/BaseCryptLib/RuntimeCryptLib.inf > > b/CryptoPkg/Library/BaseCryptLib/RuntimeCryptLib.inf > > index a59079d99e05..e99c046be29b 100644 > > --- a/CryptoPkg/Library/BaseCryptLib/RuntimeCryptLib.inf > > +++ b/CryptoPkg/Library/BaseCryptLib/RuntimeCryptLib.inf > > @@ -42,6 +42,7 @@ [Sources] > > Hmac/CryptHmacMd5Null.c > > Hmac/CryptHmacSha1Null.c > > Hmac/CryptHmacSha256Null.c > > + Kdf/CryptHkdfNull.c > > Cipher/CryptAesNull.c > > Cipher/CryptTdesNull.c > > Cipher/CryptArc4Null.c > > diff --git a/CryptoPkg/Library/BaseCryptLib/SmmCryptLib.inf > > b/CryptoPkg/Library/BaseCryptLib/SmmCryptLib.inf > > index 3fd7d65abfca..fc217938825d 100644 > > --- a/CryptoPkg/Library/BaseCryptLib/SmmCryptLib.inf > > +++ b/CryptoPkg/Library/BaseCryptLib/SmmCryptLib.inf > > @@ -42,6 +42,7 @@ [Sources] > > Hmac/CryptHmacMd5Null.c > > Hmac/CryptHmacSha1Null.c > > Hmac/CryptHmacSha256.c > > + Kdf/CryptHkdfNull.c > > Cipher/CryptAes.c > > Cipher/CryptTdesNull.c > > Cipher/CryptArc4Null.c > > diff --git a/CryptoPkg/Include/Library/BaseCryptLib.h > > b/CryptoPkg/Include/Library/BaseCryptLib.h > > index 19d1afe3c8c0..da32bb2444fd 100644 > > --- a/CryptoPkg/Include/Library/BaseCryptLib.h > > +++ b/CryptoPkg/Include/Library/BaseCryptLib.h > > @@ -3122,4 +3122,37 @@ RandomBytes ( > > IN UINTN Size > > ); > > > > > +//=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D > > =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D > > +// Key Derivation Function Primitive > > > +//=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D > > =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D > > + > > +/** > > + Derive key data using HMAC-SHA256 based KDF. > > + > > + @param[in] Key Pointer to the user-supplied key. > > + @param[in] KeySize Key size in bytes. > > + @param[in] Salt Pointer to the salt(non-secret) value. > > + @param[in] SaltSize Salt size in bytes. > > + @param[in] Info Pointer to the application specific in= fo. > > + @param[in] InfoSize Info size in bytes. > > + @param[Out] Out Pointer to buffer to receive hkdf valu= e. > > + @param[in] OutSize Size of hkdf bytes to generate. > > + > > + @retval TRUE Hkdf generated successfully. > > + @retval FALSE Hkdf generation failed. > > + > > +**/ > > +BOOLEAN > > +EFIAPI > > +HkdfSha256ExtractAndExpand ( > > + IN CONST UINT8 *Key, > > + IN UINTN KeySize, > > + IN CONST UINT8 *Salt, > > + IN UINTN SaltSize, > > + IN CONST UINT8 *Info, > > + IN UINTN InfoSize, > > + OUT UINT8 *Out, > > + IN UINTN OutSize > > + ); > > + > > #endif // __BASE_CRYPT_LIB_H__ > > diff --git a/CryptoPkg/Library/BaseCryptLib/Kdf/CryptHkdf.c > > b/CryptoPkg/Library/BaseCryptLib/Kdf/CryptHkdf.c > > new file mode 100644 > > index 000000000000..c0b307806232 > > --- /dev/null > > +++ b/CryptoPkg/Library/BaseCryptLib/Kdf/CryptHkdf.c > > @@ -0,0 +1,80 @@ > > +/** @file > > + HMAC-SHA256 KDF Wrapper Implementation over OpenSSL. > > + > > +Copyright (c) 2018 - 2019, Intel Corporation. All rights reserved.
> > +SPDX-License-Identifier: BSD-2-Clause-Patent > > + > > +**/ > > + > > +#include > > +#include > > +#include > > + > > +/** > > + Derive HMAC-based Extract-and-Expand Key Derivation Function (HKDF). > > + > > + @param[in] Key Pointer to the user-supplied key. > > + @param[in] KeySize Key size in bytes. > > + @param[in] Salt Pointer to the salt(non-secret) value. > > + @param[in] SaltSize Salt size in bytes. > > + @param[in] Info Pointer to the application specific in= fo. > > + @param[in] InfoSize Info size in bytes. > > + @param[Out] Out Pointer to buffer to receive hkdf valu= e. > > + @param[in] OutSize Size of hkdf bytes to generate. > > + > > + @retval TRUE Hkdf generated successfully. > > + @retval FALSE Hkdf generation failed. > > + > > +**/ > > +BOOLEAN > > +EFIAPI > > +HkdfSha256ExtractAndExpand ( > > + IN CONST UINT8 *Key, > > + IN UINTN KeySize, > > + IN CONST UINT8 *Salt, > > + IN UINTN SaltSize, > > + IN CONST UINT8 *Info, > > + IN UINTN InfoSize, > > + OUT UINT8 *Out, > > + IN UINTN OutSize > > + ) > > +{ > > + EVP_PKEY_CTX *pHkdfCtx; > > + > > + if (Key =3D=3D NULL || Salt =3D=3D NULL || Info =3D=3D NULL || Out = =3D=3D NULL || > > + KeySize > INT_MAX || SaltSize > INT_MAX || InfoSize > INT_MAX || > > OutSize > INT_MAX ) { > > + return FALSE; > > + } > > + > > + pHkdfCtx =3D EVP_PKEY_CTX_new_id(EVP_PKEY_HKDF, NULL); > > + if (pHkdfCtx =3D=3D NULL) { > > + goto _Error; > > + } > > + > > + if (EVP_PKEY_derive_init(pHkdfCtx) <=3D 0) { > > + goto _Error; > > + } > > + if (EVP_PKEY_CTX_set_hkdf_md(pHkdfCtx, EVP_sha256()) <=3D 0) { > > + goto _Error; > > + } > > + if (EVP_PKEY_CTX_set1_hkdf_salt(pHkdfCtx, Salt, (UINT32)SaltSize) <= =3D > 0) > > { > > + goto _Error; > > + } > > + if (EVP_PKEY_CTX_set1_hkdf_key(pHkdfCtx, Key, (UINT32)KeySize) <=3D = 0) > > { > > + goto _Error; > > + } > > + if (EVP_PKEY_CTX_add1_hkdf_info(pHkdfCtx, Info, (UINT32)InfoSize) <= =3D > 0) > > { > > + goto _Error; > > + } > > + if (EVP_PKEY_derive(pHkdfCtx, Out, &OutSize) <=3D 0) { > > + goto _Error; > > + } > > + > > + EVP_PKEY_CTX_free(pHkdfCtx); > > + pHkdfCtx =3D NULL; > > + return TRUE; > > + > > +_Error: > > + EVP_PKEY_CTX_free(pHkdfCtx); > > + return FALSE; >=20 > EVP_PKEY_CTX_free() is duplicated above. Myabe you can add a variable to > hold the > return value and merge two calling into one. >=20 > > +} > > diff --git a/CryptoPkg/Library/BaseCryptLib/Kdf/CryptHkdfNull.c > > b/CryptoPkg/Library/BaseCryptLib/Kdf/CryptHkdfNull.c > > new file mode 100644 > > index 000000000000..73deb5bc3614 > > --- /dev/null > > +++ b/CryptoPkg/Library/BaseCryptLib/Kdf/CryptHkdfNull.c > > @@ -0,0 +1,43 @@ > > +/** @file > > + HMAC-SHA256 KDF Wrapper Implementation which does not provide > > real capabilities. > > + > > +Copyright (c) 2018 - 2019, Intel Corporation. All rights reserved.
> > +SPDX-License-Identifier: BSD-2-Clause-Patent > > + > > +**/ > > + > > +#include > > +#include > > + > > +/** > > + Derive key data using HMAC-SHA256 based KDF. > > + > > + @param[in] Key Pointer to the user-supplied key. > > + @param[in] KeySize Key size in bytes. > > + @param[in] Salt Pointer to the salt(non-secret) value. > > + @param[in] SaltSize Salt size in bytes. > > + @param[in] Info Pointer to the application specific in= fo. > > + @param[in] InfoSize Info size in bytes. > > + @param[Out] Out Pointer to buffer to receive hkdf valu= e. > > + @param[in] OutSize Size of hkdf bytes to generate. > > + > > + @retval TRUE Hkdf generated successfully. > > + @retval FALSE Hkdf generation failed. > > + > > +**/ > > +BOOLEAN > > +EFIAPI > > +HkdfSha256ExtractAndExpand ( > > + IN CONST UINT8 *Key, > > + IN UINTN KeySize, > > + IN CONST UINT8 *Salt, > > + IN UINTN SaltSize, > > + IN CONST UINT8 *Info, > > + IN UINTN InfoSize, > > + OUT UINT8 *Out, > > + IN UINTN OutSize > > + ) > > +{ > > + ASSERT (FALSE); > > + return FALSE; > > +} > > -- > > 2.19.1.windows.1