From: Matthew Carlson <mac...@microsoft.com> This version of RngLib makes use of EFI_RNG_PROTOCOL to provide random number. According to UEFI spec, EFI_RNG_PROTOCOL should meet NIST SP 800-90 and/or ANSI X9.31 standards.
Ref: https://bugzilla.tianocore.org/show_bug.cgi?id=1871 Cc: Jiewen Yao <jiewen....@intel.com> Cc: Chao Zhang <chao.b.zh...@intel.com> Cc: Laszlo Ersek <ler...@redhat.com> Cc: Ard Biesheuvel <ard.biesheu...@linaro.org> Cc: Matthew Carlson <mac...@microsoft.com> Cc: Sean Brogan <sean.bro...@microsoft.com> Cc: Bret Barkelew <bret.barke...@microsoft.com> Cc: Liming Gao <liming....@intel.com> Cc: Ray Ni <ray...@intel.com> Signed-off-by: Jian J Wang <jian.j.w...@intel.com> --- .../DxeRngLibRngProtocol.c | 200 ++++++++++++++++++ .../DxeRngLibRngProtocol.inf | 42 ++++ .../DxeRngLibRngProtocol.uni | 14 ++ 3 files changed, 256 insertions(+) create mode 100644 SecurityPkg/RandomNumberGenerator/DxeRngLibRngProtocol/DxeRngLibRngProtocol.c create mode 100644 SecurityPkg/RandomNumberGenerator/DxeRngLibRngProtocol/DxeRngLibRngProtocol.inf create mode 100644 SecurityPkg/RandomNumberGenerator/DxeRngLibRngProtocol/DxeRngLibRngProtocol.uni diff --git a/SecurityPkg/RandomNumberGenerator/DxeRngLibRngProtocol/DxeRngLibRngProtocol.c b/SecurityPkg/RandomNumberGenerator/DxeRngLibRngProtocol/DxeRngLibRngProtocol.c new file mode 100644 index 0000000000..8ce4a7050d --- /dev/null +++ b/SecurityPkg/RandomNumberGenerator/DxeRngLibRngProtocol/DxeRngLibRngProtocol.c @@ -0,0 +1,200 @@ +/** @file + Provides an implementation of the library class RngLib that uses the Rng protocol. + +Copyright (c) Microsoft Corporation. All rights reserved. +Copyright (c) 2019, Intel Corporation. All rights reserved. +SPDX-License-Identifier: BSD-2-Clause-Patent + +**/ +#include <Uefi.h> +#include <Library/UefiBootServicesTableLib.h> +#include <Library/DebugLib.h> +#include <Library/RngLib.h> +#include <Protocol/Rng.h> + +/** + Generates a random number via the NIST 800-9A algorithm. Refer to + http://csrc.nist.gov/groups/STM/cavp/documents/drbg/DRBGVS.pdf + for more information. + + @param[out] Buffer Buffer to receive the random number. + @param[in] BufferSize Number of bytes in Buffer. + + @retval EFI_SUCCESS Random data generated successfully. + @retval Others Failed to generate the random number. + +**/ +STATIC +EFI_STATUS +GenerateRandomNumberViaNist800Algorithm( + OUT UINT8* Buffer, + IN UINTN BufferSize + ) +{ + EFI_STATUS Status; + EFI_RNG_PROTOCOL* RngProtocol; + + Status = EFI_UNSUPPORTED; + RngProtocol = NULL; + + if (Buffer == NULL) { + DEBUG ((DEBUG_ERROR, "[%a] Buffer == NULL.\n", __FUNCTION__)); + return EFI_INVALID_PARAMETER; + } + + if (gBS == NULL) { + DEBUG ((DEBUG_ERROR, "[%a] GenerateRandomNumber, gBS == NULL. Called too soon.\n", __FUNCTION__)); + return EFI_LOAD_ERROR; + } + + Status = gBS->LocateProtocol (&gEfiRngProtocolGuid, NULL, (VOID **)&RngProtocol); + if (EFI_ERROR (Status) || RngProtocol == NULL) { + DEBUG ((DEBUG_ERROR, "[%a] Could not locate RNG prototocol, Status = %r\n", __FUNCTION__, Status)); + return Status; + } + + Status = RngProtocol->GetRNG (RngProtocol, &gEfiRngAlgorithmSp80090Ctr256Guid, BufferSize, Buffer); + DEBUG ((DEBUG_VERBOSE, "[%a] GetRNG algorithm CTR-256 - Status = %r\n", __FUNCTION__, Status)); + if (!EFI_ERROR (Status)) { + return Status; + } + + Status = RngProtocol->GetRNG (RngProtocol, &gEfiRngAlgorithmSp80090Hmac256Guid, BufferSize, Buffer); + DEBUG ((DEBUG_VERBOSE, "[%a] GetRNG algorithm HMAC-256 - Status = %r\n", __FUNCTION__, Status)); + if (!EFI_ERROR (Status)) { + return Status; + } + + Status = RngProtocol->GetRNG (RngProtocol, &gEfiRngAlgorithmSp80090Hash256Guid, BufferSize, Buffer); + DEBUG ((DEBUG_VERBOSE, "[%a] GetRNG algorithm Hash-256 - Status = %r\n", __FUNCTION__, Status)); + if (!EFI_ERROR (Status)) { + return Status; + } + // + // If we get to this point, we have failed + // + DEBUG((DEBUG_ERROR, "[%a] GetRNG() failed, staus = %r\n", __FUNCTION__, Status)); + + return Status; +} + + +/** + Generates a 16-bit random number. + + if Rand is NULL, return FALSE. + + @param[out] Rand Buffer pointer to store the 16-bit random value. + + @retval TRUE Random number generated successfully. + @retval FALSE Failed to generate the random number. + +**/ +BOOLEAN +EFIAPI +GetRandomNumber16 ( + OUT UINT16 *Rand + ) +{ + EFI_STATUS Status; + + if (Rand == NULL) { + return FALSE; + } + + Status = GenerateRandomNumberViaNist800Algorithm ((UINT8 *)Rand, 2); + if (EFI_ERROR (Status)) { + return FALSE; + } + return TRUE; +} + +/** + Generates a 32-bit random number. + + if Rand is NULL, return FALSE. + + @param[out] Rand Buffer pointer to store the 32-bit random value. + + @retval TRUE Random number generated successfully. + @retval FALSE Failed to generate the random number. + +**/ +BOOLEAN +EFIAPI +GetRandomNumber32 ( + OUT UINT32 *Rand + ) +{ + EFI_STATUS Status; + + if (Rand == NULL) { + return FALSE; + } + + Status = GenerateRandomNumberViaNist800Algorithm ((UINT8 *)Rand, 4); + if (EFI_ERROR (Status)) { + return FALSE; + } + return TRUE; +} + +/** + Generates a 64-bit random number. + + if Rand is NULL, return FALSE. + + @param[out] Rand Buffer pointer to store the 64-bit random value. + + @retval TRUE Random number generated successfully. + @retval FALSE Failed to generate the random number. + +**/ +BOOLEAN +EFIAPI +GetRandomNumber64 ( + OUT UINT64 *Rand + ) +{ + EFI_STATUS Status; + + if (Rand == NULL) { + return FALSE; + } + + Status = GenerateRandomNumberViaNist800Algorithm ((UINT8 *)Rand, 8); + if (EFI_ERROR (Status)) { + return FALSE; + } + return TRUE; +} + +/** + Generates a 128-bit random number. + + if Rand is NULL, return FALSE. + + @param[out] Rand Buffer pointer to store the 128-bit random value. + + @retval TRUE Random number generated successfully. + @retval FALSE Failed to generate the random number. + +**/ +BOOLEAN +EFIAPI +GetRandomNumber128 ( + OUT UINT64 *Rand + ) +{ + EFI_STATUS Status; + + if (Rand == NULL) { + return FALSE; + } + + Status = GenerateRandomNumberViaNist800Algorithm ((UINT8 *)Rand, 16); + if (EFI_ERROR (Status)) { + return FALSE; + } + return TRUE; +} diff --git a/SecurityPkg/RandomNumberGenerator/DxeRngLibRngProtocol/DxeRngLibRngProtocol.inf b/SecurityPkg/RandomNumberGenerator/DxeRngLibRngProtocol/DxeRngLibRngProtocol.inf new file mode 100644 index 0000000000..d47fe3be53 --- /dev/null +++ b/SecurityPkg/RandomNumberGenerator/DxeRngLibRngProtocol/DxeRngLibRngProtocol.inf @@ -0,0 +1,42 @@ +# @file +# Provides implementation of the library class RngLib that uses the RngProtocol +# +# @copyright +# Copyright (c) Microsoft Corporation. All rights reserved. +# SPDX-License-Identifier: BSD-2-Clause-Patent +# +## + +[Defines] + INF_VERSION = 0x00010029 + BASE_NAME = DxeRngLibRngProtocol + MODULE_UNI_FILE = DxeRngLibRngProtocol.uni + FILE_GUID = FF9F84C5-A33E-44E3-9BB5-0D654B2D4149 + MODULE_TYPE = DXE_DRIVER + VERSION_STRING = 1.0 + LIBRARY_CLASS = RngLib|DXE_DRIVER DXE_RUNTIME_DRIVER DXE_SMM_DRIVER UEFI_APPLICATION UEFI_DRIVER + +# +# VALID_ARCHITECTURES = IA32 X64 EBC ARM AARCH64 +# + +[Packages] + MdePkg/MdePkg.dec + +[Sources] + DxeRngLibRngProtocol.c + +[LibraryClasses] + DebugLib + UefiBootServicesTableLib + +[Protocols] + gEfiRngProtocolGuid ## CONSUMES + +[Depex] + gEfiRngProtocolGuid + +[Guids] + gEfiRngAlgorithmSp80090Ctr256Guid ## CONSUMES + gEfiRngAlgorithmSp80090Hash256Guid ## CONSUMES + gEfiRngAlgorithmSp80090Hmac256Guid ## CONSUMES diff --git a/SecurityPkg/RandomNumberGenerator/DxeRngLibRngProtocol/DxeRngLibRngProtocol.uni b/SecurityPkg/RandomNumberGenerator/DxeRngLibRngProtocol/DxeRngLibRngProtocol.uni new file mode 100644 index 0000000000..09af056bd3 --- /dev/null +++ b/SecurityPkg/RandomNumberGenerator/DxeRngLibRngProtocol/DxeRngLibRngProtocol.uni @@ -0,0 +1,14 @@ +// /** @file +// Instance of RNG (Random Number Generator) Library Based on EFI_RNG_PROTOCOL. +// +// Copyright (c) 2019, Intel Corporation. All rights reserved.<BR> +// +// SPDX-License-Identifier: BSD-2-Clause-Patent +// +// **/ + + +#string STR_MODULE_ABSTRACT #language en-US "Instance of RNG Library Based on EFI_RNG_PROTOCOL." + +#string STR_MODULE_DESCRIPTION #language en-US "This version of RNG library makes use of EFI_RNG_PROTOCOL to generate random number compliant with NIST 800-9A." + -- 2.17.1.windows.2 -=-=-=-=-=-=-=-=-=-=-=- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#50612): https://edk2.groups.io/g/devel/message/50612 Mute This Topic: https://groups.io/mt/56714115/21656 Group Owner: devel+ow...@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [arch...@mail-archive.com] -=-=-=-=-=-=-=-=-=-=-=-
