Hi Qingyu, 1. Commit message is not clear enough, we need to clarify 'why removing SHA-1 code does not affect the functionality of Rand'. Could you please add: The default drbg type of randlib has been switched to aes_256_ctr in openssl1.1.1, so sha1 is not really used in RandomSeed().
2. Please remove sha1 in BaseCryptLib\Rand\CryptRand.c also. Thanks, Yi -----Original Message----- From: Shang, Qingyu <qingyu.sh...@intel.com> Sent: Wednesday, May 15, 2024 11:04 PM To: devel@edk2.groups.io Cc: Yao, Jiewen <jiewen....@intel.com>; Li, Yi1 <yi1...@intel.com> Subject: [PATCH 1/1] CryptoPkg: Remove deprecated code related to SHA-1 REF: https://bugzilla.tianocore.org/show_bug.cgi?id=4698 SHA-1 is deprecated by NIST for any cryptographic use. Remove related code which do SHA-1 support checking in CryptRandTsc.c Signed-off-by: Shang Qingyu <qingyu.sh...@intel.com> Cc: Jiewen Yao <jiewen....@intel.com> Cc: Yi Li <yi1...@intel.com> --- CryptoPkg/Library/BaseCryptLib/Rand/CryptRandTsc.c | 8 -------- 1 file changed, 8 deletions(-) diff --git a/CryptoPkg/Library/BaseCryptLib/Rand/CryptRandTsc.c b/CryptoPkg/Library/BaseCryptLib/Rand/CryptRandTsc.c index 30454bf10f9b..b94c16de562d 100644 --- a/CryptoPkg/Library/BaseCryptLib/Rand/CryptRandTsc.c +++ b/CryptoPkg/Library/BaseCryptLib/Rand/CryptRandTsc.c @@ -40,14 +40,6 @@ RandomSeed ( return FALSE; } - // - // The software PRNG implementation built in OpenSSL depends on message digest algorithm. - // Make sure SHA-1 digest algorithm is available here. - // - if (EVP_add_digest (EVP_sha1 ()) == 0) { - return FALSE; - } - // // Seed the pseudorandom number generator with user-supplied value. // NOTE: A cryptographic PRNG must be seeded with unpredictable data. -- 2.44.0.windows.1 -=-=-=-=-=-=-=-=-=-=-=- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#118925): https://edk2.groups.io/g/devel/message/118925 Mute This Topic: https://groups.io/mt/106115677/21656 Group Owner: devel+ow...@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [arch...@mail-archive.com] -=-=-=-=-=-=-=-=-=-=-=-
