[edk2-devel] [PATCH 1/1] CryptoPkg: Remove deprecated code related to SHA-1

[edk2-devel] [PATCH 1/1] CryptoPkg: Remove deprecated code related to SHA-1

[Qingyu]

REF: https://bugzilla.tianocore.org/show_bug.cgi?id=4698

SHA-1 is deprecated by NIST for any cryptographic use. Remove related code
which do SHA-1 support checking in CryptRandTsc.c

Signed-off-by: Shang Qingyu <qingyu.shang@intel.com>
Cc: Jiewen Yao <jiewen.yao@intel.com>
Cc: Yi Li <yi1.li@intel.com>
---
 CryptoPkg/Library/BaseCryptLib/Rand/CryptRandTsc.c | 8 --------
 1 file changed, 8 deletions(-)

diff --git a/CryptoPkg/Library/BaseCryptLib/Rand/CryptRandTsc.c b/CryptoPkg/Library/BaseCryptLib/Rand/CryptRandTsc.c
index 30454bf10f9b..b94c16de562d 100644
--- a/CryptoPkg/Library/BaseCryptLib/Rand/CryptRandTsc.c
+++ b/CryptoPkg/Library/BaseCryptLib/Rand/CryptRandTsc.c
@@ -40,14 +40,6 @@ RandomSeed (
     return FALSE;
   }
 
-  //
-  // The software PRNG implementation built in OpenSSL depends on message digest algorithm.
-  // Make sure SHA-1 digest algorithm is available here.
-  //
-  if (EVP_add_digest (EVP_sha1 ()) == 0) {
-    return FALSE;
-  }
-
   //
   // Seed the pseudorandom number generator with user-supplied value.
   // NOTE: A cryptographic PRNG must be seeded with unpredictable data.
-- 
2.44.0.windows.1



-=-=-=-=-=-=-=-=-=-=-=-
Groups.io Links: You receive all messages sent to this group.
View/Reply Online (#118921): https://edk2.groups.io/g/devel/message/118921
Mute This Topic: https://groups.io/mt/106115677/7686176
Group Owner: devel+owner@edk2.groups.io
Unsubscribe: https://edk2.groups.io/g/devel/unsub [rebecca@openfw.io]
-=-=-=-=-=-=-=-=-=-=-=-

Re: [edk2-devel] [PATCH 1/1] CryptoPkg: Remove deprecated code related to SHA-1

[Li, Yi]

Hi Qingyu,

1. Commit message is not clear enough, we need to clarify 'why removing SHA-1 code does not affect the functionality of Rand'.
Could you please add:
The default drbg type of randlib has been switched to aes_256_ctr in openssl1.1.1, so sha1 is not really used in RandomSeed().

2. Please remove sha1 in BaseCryptLib\Rand\CryptRand.c also.

Thanks,
Yi

-----Original Message-----
From: Shang, Qingyu <qingyu.shang@intel.com> 
Sent: Wednesday, May 15, 2024 11:04 PM
To: devel@edk2.groups.io
Cc: Yao, Jiewen <jiewen.yao@intel.com>; Li, Yi1 <yi1.li@intel.com>
Subject: [PATCH 1/1] CryptoPkg: Remove deprecated code related to SHA-1

REF: https://bugzilla.tianocore.org/show_bug.cgi?id=4698

SHA-1 is deprecated by NIST for any cryptographic use. Remove related code which do SHA-1 support checking in CryptRandTsc.c

Signed-off-by: Shang Qingyu <qingyu.shang@intel.com>
Cc: Jiewen Yao <jiewen.yao@intel.com>
Cc: Yi Li <yi1.li@intel.com>
---
 CryptoPkg/Library/BaseCryptLib/Rand/CryptRandTsc.c | 8 --------
 1 file changed, 8 deletions(-)

diff --git a/CryptoPkg/Library/BaseCryptLib/Rand/CryptRandTsc.c b/CryptoPkg/Library/BaseCryptLib/Rand/CryptRandTsc.c
index 30454bf10f9b..b94c16de562d 100644
--- a/CryptoPkg/Library/BaseCryptLib/Rand/CryptRandTsc.c
+++ b/CryptoPkg/Library/BaseCryptLib/Rand/CryptRandTsc.c
@@ -40,14 +40,6 @@ RandomSeed (
     return FALSE;
   }
 
-  //
-  // The software PRNG implementation built in OpenSSL depends on message digest algorithm.
-  // Make sure SHA-1 digest algorithm is available here.
-  //
-  if (EVP_add_digest (EVP_sha1 ()) == 0) {
-    return FALSE;
-  }
-
   //
   // Seed the pseudorandom number generator with user-supplied value.
   // NOTE: A cryptographic PRNG must be seeded with unpredictable data.
--
2.44.0.windows.1



-=-=-=-=-=-=-=-=-=-=-=-
Groups.io Links: You receive all messages sent to this group.
View/Reply Online (#118925): https://edk2.groups.io/g/devel/message/118925
Mute This Topic: https://groups.io/mt/106115677/7686176
Group Owner: devel+owner@edk2.groups.io
Unsubscribe: https://edk2.groups.io/g/devel/unsub [rebecca@openfw.io]
-=-=-=-=-=-=-=-=-=-=-=-