Laszlo,
> -----Original Message----- > From: Laszlo Ersek <ler...@redhat.com> > Sent: Thursday, November 14, 2019 7:16 PM > To: devel@edk2.groups.io; Wang, Jian J <jian.j.w...@intel.com> > Cc: Yao, Jiewen <jiewen....@intel.com>; Zhang, Chao B > <chao.b.zh...@intel.com>; Ard Biesheuvel <ard.biesheu...@linaro.org>; > Matthew Carlson <mac...@microsoft.com>; Sean Brogan > <sean.bro...@microsoft.com>; Bret Barkelew > <bret.barke...@microsoft.com>; Gao, Liming <liming....@intel.com>; Ni, Ray > <ray...@intel.com> > Subject: Re: [edk2-devel] [PATCH 06/11] SecurityPkg/DxeRngLibRngProtocol: > add RNG protocol version of RngLib > > On 11/14/19 03:17, Wang, Jian J wrote: > > From: Matthew Carlson <mac...@microsoft.com> > > > > This version of RngLib makes use of EFI_RNG_PROTOCOL to provide random > > number. According to UEFI spec, EFI_RNG_PROTOCOL should meet NIST SP > > 800-90 and/or ANSI X9.31 standards. > > I'd like to slightly correct the UEFI spec reference. In UEFI-2.8, > section "37.5.1 EFI RNG Algorithm Definitions" writes, > > [...] The algorithms listed are optional, not meant to be exhaustive > and may be augmented by vendors or other industry standards. [...] > > Meaning that an EFI_RNG_PROTOCOL instance is not "required", per spec, > to support any one of the > - gEfiRngAlgorithmSp80090Ctr256Guid > - gEfiRngAlgorithmSp80090Hmac256Guid > - gEfiRngAlgorithmSp80090Hash256Guid > algorithms. > > It's of course fine to require one of those algorithms, as a policy > decision, in this particular library instance -- but, as far as I can > tell, that decision does not follow from the spec. > I think you're right about the spec. Although they're not "required" ones, we can still suggest to follow the NIST/ANSI spec about random entropy in the implementation of EFI_RNG_PROTOCOL. Regards, Jian > Thanks > Laszlo > > > > > Ref: https://bugzilla.tianocore.org/show_bug.cgi?id=1871 > > Cc: Jiewen Yao <jiewen....@intel.com> > > Cc: Chao Zhang <chao.b.zh...@intel.com> > > Cc: Laszlo Ersek <ler...@redhat.com> > > Cc: Ard Biesheuvel <ard.biesheu...@linaro.org> > > Cc: Matthew Carlson <mac...@microsoft.com> > > Cc: Sean Brogan <sean.bro...@microsoft.com> > > Cc: Bret Barkelew <bret.barke...@microsoft.com> > > Cc: Liming Gao <liming....@intel.com> > > Cc: Ray Ni <ray...@intel.com> > > Signed-off-by: Jian J Wang <jian.j.w...@intel.com> > > --- > > .../DxeRngLibRngProtocol.c | 200 ++++++++++++++++++ > > .../DxeRngLibRngProtocol.inf | 42 ++++ > > .../DxeRngLibRngProtocol.uni | 14 ++ > > 3 files changed, 256 insertions(+) > > create mode 100644 > SecurityPkg/RandomNumberGenerator/DxeRngLibRngProtocol/DxeRngLibRngPr > otocol.c > > create mode 100644 > SecurityPkg/RandomNumberGenerator/DxeRngLibRngProtocol/DxeRngLibRngPr > otocol.inf > > create mode 100644 > SecurityPkg/RandomNumberGenerator/DxeRngLibRngProtocol/DxeRngLibRngPr > otocol.uni > > > > diff --git > a/SecurityPkg/RandomNumberGenerator/DxeRngLibRngProtocol/DxeRngLibRn > gProtocol.c > b/SecurityPkg/RandomNumberGenerator/DxeRngLibRngProtocol/DxeRngLibRn > gProtocol.c > > new file mode 100644 > > index 0000000000..8ce4a7050d > > --- /dev/null > > +++ > b/SecurityPkg/RandomNumberGenerator/DxeRngLibRngProtocol/DxeRngLibRn > gProtocol.c > > @@ -0,0 +1,200 @@ > > +/** @file > > + Provides an implementation of the library class RngLib that uses the Rng > protocol. > > + > > +Copyright (c) Microsoft Corporation. All rights reserved. > > +Copyright (c) 2019, Intel Corporation. All rights reserved. > > +SPDX-License-Identifier: BSD-2-Clause-Patent > > + > > +**/ > > +#include <Uefi.h> > > +#include <Library/UefiBootServicesTableLib.h> > > +#include <Library/DebugLib.h> > > +#include <Library/RngLib.h> > > +#include <Protocol/Rng.h> > > + > > +/** > > + Generates a random number via the NIST 800-9A algorithm. Refer to > > + http://csrc.nist.gov/groups/STM/cavp/documents/drbg/DRBGVS.pdf > > + for more information. > > + > > + @param[out] Buffer Buffer to receive the random number. > > + @param[in] BufferSize Number of bytes in Buffer. > > + > > + @retval EFI_SUCCESS Random data generated successfully. > > + @retval Others Failed to generate the random number. > > + > > +**/ > > +STATIC > > +EFI_STATUS > > +GenerateRandomNumberViaNist800Algorithm( > > + OUT UINT8* Buffer, > > + IN UINTN BufferSize > > + ) > > +{ > > + EFI_STATUS Status; > > + EFI_RNG_PROTOCOL* RngProtocol; > > + > > + Status = EFI_UNSUPPORTED; > > + RngProtocol = NULL; > > + > > + if (Buffer == NULL) { > > + DEBUG ((DEBUG_ERROR, "[%a] Buffer == NULL.\n", __FUNCTION__)); > > + return EFI_INVALID_PARAMETER; > > + } > > + > > + if (gBS == NULL) { > > + DEBUG ((DEBUG_ERROR, "[%a] GenerateRandomNumber, gBS == NULL. > Called too soon.\n", __FUNCTION__)); > > + return EFI_LOAD_ERROR; > > + } > > + > > + Status = gBS->LocateProtocol (&gEfiRngProtocolGuid, NULL, (VOID > **)&RngProtocol); > > + if (EFI_ERROR (Status) || RngProtocol == NULL) { > > + DEBUG ((DEBUG_ERROR, "[%a] Could not locate RNG prototocol, Status > = %r\n", __FUNCTION__, Status)); > > + return Status; > > + } > > + > > + Status = RngProtocol->GetRNG (RngProtocol, > &gEfiRngAlgorithmSp80090Ctr256Guid, BufferSize, Buffer); > > + DEBUG ((DEBUG_VERBOSE, "[%a] GetRNG algorithm CTR-256 - Status > = %r\n", __FUNCTION__, Status)); > > + if (!EFI_ERROR (Status)) { > > + return Status; > > + } > > + > > + Status = RngProtocol->GetRNG (RngProtocol, > &gEfiRngAlgorithmSp80090Hmac256Guid, BufferSize, Buffer); > > + DEBUG ((DEBUG_VERBOSE, "[%a] GetRNG algorithm HMAC-256 - Status > = %r\n", __FUNCTION__, Status)); > > + if (!EFI_ERROR (Status)) { > > + return Status; > > + } > > + > > + Status = RngProtocol->GetRNG (RngProtocol, > &gEfiRngAlgorithmSp80090Hash256Guid, BufferSize, Buffer); > > + DEBUG ((DEBUG_VERBOSE, "[%a] GetRNG algorithm Hash-256 - Status > = %r\n", __FUNCTION__, Status)); > > + if (!EFI_ERROR (Status)) { > > + return Status; > > + } > > + // > > + // If we get to this point, we have failed > > + // > > + DEBUG((DEBUG_ERROR, "[%a] GetRNG() failed, staus = %r\n", > __FUNCTION__, Status)); > > + > > + return Status; > > +} > > + > > + > > +/** > > + Generates a 16-bit random number. > > + > > + if Rand is NULL, return FALSE. > > + > > + @param[out] Rand Buffer pointer to store the 16-bit random value. > > + > > + @retval TRUE Random number generated successfully. > > + @retval FALSE Failed to generate the random number. > > + > > +**/ > > +BOOLEAN > > +EFIAPI > > +GetRandomNumber16 ( > > + OUT UINT16 *Rand > > + ) > > +{ > > + EFI_STATUS Status; > > + > > + if (Rand == NULL) { > > + return FALSE; > > + } > > + > > + Status = GenerateRandomNumberViaNist800Algorithm ((UINT8 *)Rand, 2); > > + if (EFI_ERROR (Status)) { > > + return FALSE; > > + } > > + return TRUE; > > +} > > + > > +/** > > + Generates a 32-bit random number. > > + > > + if Rand is NULL, return FALSE. > > + > > + @param[out] Rand Buffer pointer to store the 32-bit random value. > > + > > + @retval TRUE Random number generated successfully. > > + @retval FALSE Failed to generate the random number. > > + > > +**/ > > +BOOLEAN > > +EFIAPI > > +GetRandomNumber32 ( > > + OUT UINT32 *Rand > > + ) > > +{ > > + EFI_STATUS Status; > > + > > + if (Rand == NULL) { > > + return FALSE; > > + } > > + > > + Status = GenerateRandomNumberViaNist800Algorithm ((UINT8 *)Rand, 4); > > + if (EFI_ERROR (Status)) { > > + return FALSE; > > + } > > + return TRUE; > > +} > > + > > +/** > > + Generates a 64-bit random number. > > + > > + if Rand is NULL, return FALSE. > > + > > + @param[out] Rand Buffer pointer to store the 64-bit random value. > > + > > + @retval TRUE Random number generated successfully. > > + @retval FALSE Failed to generate the random number. > > + > > +**/ > > +BOOLEAN > > +EFIAPI > > +GetRandomNumber64 ( > > + OUT UINT64 *Rand > > + ) > > +{ > > + EFI_STATUS Status; > > + > > + if (Rand == NULL) { > > + return FALSE; > > + } > > + > > + Status = GenerateRandomNumberViaNist800Algorithm ((UINT8 *)Rand, 8); > > + if (EFI_ERROR (Status)) { > > + return FALSE; > > + } > > + return TRUE; > > +} > > + > > +/** > > + Generates a 128-bit random number. > > + > > + if Rand is NULL, return FALSE. > > + > > + @param[out] Rand Buffer pointer to store the 128-bit random value. > > + > > + @retval TRUE Random number generated successfully. > > + @retval FALSE Failed to generate the random number. > > + > > +**/ > > +BOOLEAN > > +EFIAPI > > +GetRandomNumber128 ( > > + OUT UINT64 *Rand > > + ) > > +{ > > + EFI_STATUS Status; > > + > > + if (Rand == NULL) { > > + return FALSE; > > + } > > + > > + Status = GenerateRandomNumberViaNist800Algorithm ((UINT8 *)Rand, 16); > > + if (EFI_ERROR (Status)) { > > + return FALSE; > > + } > > + return TRUE; > > +} > > diff --git > a/SecurityPkg/RandomNumberGenerator/DxeRngLibRngProtocol/DxeRngLibRn > gProtocol.inf > b/SecurityPkg/RandomNumberGenerator/DxeRngLibRngProtocol/DxeRngLibRn > gProtocol.inf > > new file mode 100644 > > index 0000000000..d47fe3be53 > > --- /dev/null > > +++ > b/SecurityPkg/RandomNumberGenerator/DxeRngLibRngProtocol/DxeRngLibRn > gProtocol.inf > > @@ -0,0 +1,42 @@ > > +# @file > > +# Provides implementation of the library class RngLib that uses the > RngProtocol > > +# > > +# @copyright > > +# Copyright (c) Microsoft Corporation. All rights reserved. > > +# SPDX-License-Identifier: BSD-2-Clause-Patent > > +# > > +## > > + > > +[Defines] > > + INF_VERSION = 0x00010029 > > + BASE_NAME = DxeRngLibRngProtocol > > + MODULE_UNI_FILE = DxeRngLibRngProtocol.uni > > + FILE_GUID = FF9F84C5-A33E-44E3-9BB5-0D654B2D4149 > > + MODULE_TYPE = DXE_DRIVER > > + VERSION_STRING = 1.0 > > + LIBRARY_CLASS = RngLib|DXE_DRIVER DXE_RUNTIME_DRIVER > DXE_SMM_DRIVER UEFI_APPLICATION UEFI_DRIVER > > + > > +# > > +# VALID_ARCHITECTURES = IA32 X64 EBC ARM AARCH64 > > +# > > + > > +[Packages] > > + MdePkg/MdePkg.dec > > + > > +[Sources] > > + DxeRngLibRngProtocol.c > > + > > +[LibraryClasses] > > + DebugLib > > + UefiBootServicesTableLib > > + > > +[Protocols] > > + gEfiRngProtocolGuid ## CONSUMES > > + > > +[Depex] > > + gEfiRngProtocolGuid > > + > > +[Guids] > > + gEfiRngAlgorithmSp80090Ctr256Guid ## CONSUMES > > + gEfiRngAlgorithmSp80090Hash256Guid ## CONSUMES > > + gEfiRngAlgorithmSp80090Hmac256Guid ## CONSUMES > > diff --git > a/SecurityPkg/RandomNumberGenerator/DxeRngLibRngProtocol/DxeRngLibRn > gProtocol.uni > b/SecurityPkg/RandomNumberGenerator/DxeRngLibRngProtocol/DxeRngLibRn > gProtocol.uni > > new file mode 100644 > > index 0000000000..09af056bd3 > > --- /dev/null > > +++ > b/SecurityPkg/RandomNumberGenerator/DxeRngLibRngProtocol/DxeRngLibRn > gProtocol.uni > > @@ -0,0 +1,14 @@ > > +// /** @file > > +// Instance of RNG (Random Number Generator) Library Based on > EFI_RNG_PROTOCOL. > > +// > > +// Copyright (c) 2019, Intel Corporation. All rights reserved.<BR> > > +// > > +// SPDX-License-Identifier: BSD-2-Clause-Patent > > +// > > +// **/ > > + > > + > > +#string STR_MODULE_ABSTRACT #language en-US "Instance of RNG > Library Based on EFI_RNG_PROTOCOL." > > + > > +#string STR_MODULE_DESCRIPTION #language en-US "This version of > RNG library makes use of EFI_RNG_PROTOCOL to generate random number > compliant with NIST 800-9A." > > + > > -=-=-=-=-=-=-=-=-=-=-=- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#50673): https://edk2.groups.io/g/devel/message/50673 Mute This Topic: https://groups.io/mt/56714115/21656 Group Owner: devel+ow...@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [arch...@mail-archive.com] -=-=-=-=-=-=-=-=-=-=-=-
