Reviewed-by: Jiewen Yao <[email protected]> Merged https://github.com/tianocore/edk2/pull/4798
> -----Original Message----- > From: Sheng, W <[email protected]> > Sent: Thursday, September 7, 2023 9:57 AM > To: [email protected] > Cc: Yao, Jiewen <[email protected]>; Wang, Jian J <[email protected]>; > Xu, Min M <[email protected]>; Chen, Zeyi <[email protected]>; Wang, > Fiona <[email protected]>; Lu, Xiaoyu1 <[email protected]>; Jiang, > Guomin <[email protected]>; Kinney, Michael D > <[email protected]> > Subject: [PATCH V9 0/2] Support RSA4096 and RSA3072 > > Patch V9: > Refine coding format for file AuthService.c > > Patch V8: > Update the patch comments for CryptoPkg. > Comment should be <76 characters in each line. > Refine coding format. > > Patch V7: > Drop raw RSA3072 and RSA4096. Only use gEfiCertX509Guid for RSA3072 and > RSA4096 > Do the positive tests and the negative tests below. And got all the expected > results. > > Patch V6: > Remove the changes in MdePkg. > The changes of patch v6 are in CryptoPkg and SecurityPkg. > Set signature type to gEfiCertX509Guid when enroll RSA3072/RSA4096 KEK. > This signature type is used to check the supported signature and show the > strings. > > Patch V5: > Using define KEY_TYPE_RSASSA to replace the magic number. > > Patch V4: > Determine the RSA algorithm by a supported algorithm list. > > Patch V3: > Select SHA algorithm automaticly for a unsigned efi image. > > Patch V2: > Determine the SHA algorithm by a supported algorithm list. > Create SHA context for each algorithm. > > Test Case: > 1. Enroll a RSA4096 Cert, and execute an RSA4096 signed efi image under UEFI > shell. > 2. Enroll a RSA3072 Cert, and execute an RSA3072 signed efi image under UEFI > shell. > 3. Enroll a RSA2048 Cert, and execute an RSA2048 signed efi image under UEFI > shell. > 4. Enroll an unsigned efi image, execute the unsigned efi image under UEFI > shell > > Test Result: > Pass > > Negative Test Case: > 1) Enroll a RSA2048 Cert, execute an unsigned efi image. > 2) Enroll a RSA2048 Cert, execute a RSA4096 signed efi image. > 3) Enroll a RSA4096 Cert, execute a RSA3072 signed efi image. > 4) Enroll a RSA4096 Cert to both DB and DBX, execute the RSA4096 signed efi > image. > > Test Result: > Get "Access Denied" when try to execute the efi image. > > Cc: Jiewen Yao <[email protected]> > Cc: Jian J Wang <[email protected]> > Cc: Min Xu <[email protected]> > Cc: Zeyi Chen <[email protected]> > Cc: Fiona Wang <[email protected]> > Cc: Xiaoyu Lu <[email protected]> > Cc: Guomin Jiang <[email protected]> > Cc: Michael D Kinney <[email protected]> > > Sheng Wei (2): > CryptoPkg/BaseCryptLib: add sha384 and sha512 to ImageTimestampVerify > SecurityPkg/SecureBoot: Support RSA4096 and RSA3072 > > CryptoPkg/Library/BaseCryptLib/Pk/CryptTs.c | 3 +- > .../Library/AuthVariableLib/AuthService.c | 225 +++++++++++++++--- > .../AuthVariableLib/AuthServiceInternal.h | 4 +- > .../Library/AuthVariableLib/AuthVariableLib.c | 42 ++-- > .../DxeImageVerificationLib.c | 74 +++--- > .../SecureBootConfigDxe.inf | 8 + > .../SecureBootConfigImpl.c | 52 +++- > .../SecureBootConfigImpl.h | 7 + > .../SecureBootConfigStrings.uni | 2 + > 9 files changed, 331 insertions(+), 86 deletions(-) > > -- > 2.26.2.windows.1 -=-=-=-=-=-=-=-=-=-=-=- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#108360): https://edk2.groups.io/g/devel/message/108360 Mute This Topic: https://groups.io/mt/101207366/21656 Group Owner: [email protected] Unsubscribe: https://edk2.groups.io/g/devel/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
