From: Sean Brogan <sean.brogan@microsoft.com>

https://bugzilla.tianocore.org/show_bug.cgi?id=2257

Add a Null instance of the BaseCryptLib class.  This lib instance
can be used as a template for new implementations of the BaseCryptLib
class and can also be used to reduce CI build times for build
checks that depend on the BaseCryptLib class.

Cc: Jian J Wang <jian.j.wang@intel.com>
Cc: Xiaoyu Lu <xiaoyux.lu@intel.com>
Signed-off-by: Michael D Kinney <michael.d.kinney@intel.com>
---
 CryptoPkg/CryptoPkg.dsc                       |   1 +
 .../BaseCryptLibNull/BaseCryptLibNull.inf     |  62 ++++
 .../BaseCryptLibNull/BaseCryptLibNull.uni     |  18 ++
 .../BaseCryptLibNull/Cipher/CryptAesNull.c    | 159 ++++++++++
 .../BaseCryptLibNull/Cipher/CryptArc4Null.c   | 124 ++++++++
 .../BaseCryptLibNull/Cipher/CryptTdesNull.c   | 160 ++++++++++
 .../BaseCryptLibNull/Hash/CryptMd4Null.c      | 143 +++++++++
 .../BaseCryptLibNull/Hash/CryptMd5Null.c      | 165 +++++++++++
 .../BaseCryptLibNull/Hash/CryptSha1Null.c     | 167 +++++++++++
 .../BaseCryptLibNull/Hash/CryptSha256Null.c   | 162 +++++++++++
 .../BaseCryptLibNull/Hash/CryptSha512Null.c   | 275 ++++++++++++++++++
 .../BaseCryptLibNull/Hash/CryptSm3Null.c      | 164 +++++++++++
 .../BaseCryptLibNull/Hmac/CryptHmacMd5Null.c  | 159 ++++++++++
 .../BaseCryptLibNull/Hmac/CryptHmacSha1Null.c | 159 ++++++++++
 .../Hmac/CryptHmacSha256Null.c                | 159 ++++++++++
 .../BaseCryptLibNull/InternalCryptLib.h       |  16 +
 .../BaseCryptLibNull/Pem/CryptPemNull.c       |  38 +++
 .../Pk/CryptAuthenticodeNull.c                |  45 +++
 .../Library/BaseCryptLibNull/Pk/CryptDhNull.c | 150 ++++++++++
 .../BaseCryptLibNull/Pk/CryptPkcs1OaepNull.c  |  51 ++++
 .../Pk/CryptPkcs5Pbkdf2Null.c                 |  48 +++
 .../BaseCryptLibNull/Pk/CryptPkcs7SignNull.c  |  54 ++++
 .../Pk/CryptPkcs7VerifyEkuNull.c              | 156 ++++++++++
 .../Pk/CryptPkcs7VerifyNull.c                 | 163 +++++++++++
 .../BaseCryptLibNull/Pk/CryptRsaBasicNull.c   | 121 ++++++++
 .../BaseCryptLibNull/Pk/CryptRsaExtNull.c     | 119 ++++++++
 .../Library/BaseCryptLibNull/Pk/CryptTsNull.c |  42 +++
 .../BaseCryptLibNull/Pk/CryptX509Null.c       | 264 +++++++++++++++++
 .../BaseCryptLibNull/Rand/CryptRandNull.c     |  57 ++++
 29 files changed, 3401 insertions(+)
 create mode 100644 CryptoPkg/Library/BaseCryptLibNull/BaseCryptLibNull.inf
 create mode 100644 CryptoPkg/Library/BaseCryptLibNull/BaseCryptLibNull.uni
 create mode 100644 CryptoPkg/Library/BaseCryptLibNull/Cipher/CryptAesNull.c
 create mode 100644 CryptoPkg/Library/BaseCryptLibNull/Cipher/CryptArc4Null.c
 create mode 100644 CryptoPkg/Library/BaseCryptLibNull/Cipher/CryptTdesNull.c
 create mode 100644 CryptoPkg/Library/BaseCryptLibNull/Hash/CryptMd4Null.c
 create mode 100644 CryptoPkg/Library/BaseCryptLibNull/Hash/CryptMd5Null.c
 create mode 100644 CryptoPkg/Library/BaseCryptLibNull/Hash/CryptSha1Null.c
 create mode 100644 CryptoPkg/Library/BaseCryptLibNull/Hash/CryptSha256Null.c
 create mode 100644 CryptoPkg/Library/BaseCryptLibNull/Hash/CryptSha512Null.c
 create mode 100644 CryptoPkg/Library/BaseCryptLibNull/Hash/CryptSm3Null.c
 create mode 100644 CryptoPkg/Library/BaseCryptLibNull/Hmac/CryptHmacMd5Null.c
 create mode 100644 CryptoPkg/Library/BaseCryptLibNull/Hmac/CryptHmacSha1Null.c
 create mode 100644 CryptoPkg/Library/BaseCryptLibNull/Hmac/CryptHmacSha256Null.c
 create mode 100644 CryptoPkg/Library/BaseCryptLibNull/InternalCryptLib.h
 create mode 100644 CryptoPkg/Library/BaseCryptLibNull/Pem/CryptPemNull.c
 create mode 100644 CryptoPkg/Library/BaseCryptLibNull/Pk/CryptAuthenticodeNull.c
 create mode 100644 CryptoPkg/Library/BaseCryptLibNull/Pk/CryptDhNull.c
 create mode 100644 CryptoPkg/Library/BaseCryptLibNull/Pk/CryptPkcs1OaepNull.c
 create mode 100644 CryptoPkg/Library/BaseCryptLibNull/Pk/CryptPkcs5Pbkdf2Null.c
 create mode 100644 CryptoPkg/Library/BaseCryptLibNull/Pk/CryptPkcs7SignNull.c
 create mode 100644 CryptoPkg/Library/BaseCryptLibNull/Pk/CryptPkcs7VerifyEkuNull.c
 create mode 100644 CryptoPkg/Library/BaseCryptLibNull/Pk/CryptPkcs7VerifyNull.c
 create mode 100644 CryptoPkg/Library/BaseCryptLibNull/Pk/CryptRsaBasicNull.c
 create mode 100644 CryptoPkg/Library/BaseCryptLibNull/Pk/CryptRsaExtNull.c
 create mode 100644 CryptoPkg/Library/BaseCryptLibNull/Pk/CryptTsNull.c
 create mode 100644 CryptoPkg/Library/BaseCryptLibNull/Pk/CryptX509Null.c
 create mode 100644 CryptoPkg/Library/BaseCryptLibNull/Rand/CryptRandNull.c

diff --git a/CryptoPkg/CryptoPkg.dsc b/CryptoPkg/CryptoPkg.dsc
index c90e76c721..3e5045e835 100644
--- a/CryptoPkg/CryptoPkg.dsc
+++ b/CryptoPkg/CryptoPkg.dsc
@@ -114,6 +114,7 @@ [Components]
   CryptoPkg/Library/BaseCryptLib/BaseCryptLib.inf
   CryptoPkg/Library/BaseCryptLib/PeiCryptLib.inf
   CryptoPkg/Library/BaseCryptLib/RuntimeCryptLib.inf
+  CryptoPkg/Library/BaseCryptLibNull/BaseCryptLibNull.inf
   CryptoPkg/Library/TlsLib/TlsLib.inf
   CryptoPkg/Library/OpensslLib/OpensslLib.inf
   CryptoPkg/Library/OpensslLib/OpensslLibCrypto.inf
diff --git a/CryptoPkg/Library/BaseCryptLibNull/BaseCryptLibNull.inf b/CryptoPkg/Library/BaseCryptLibNull/BaseCryptLibNull.inf
new file mode 100644
index 0000000000..1e4807968a
--- /dev/null
+++ b/CryptoPkg/Library/BaseCryptLibNull/BaseCryptLibNull.inf
@@ -0,0 +1,62 @@
+## @file
+#  Cryptographic Library Null Instance.
+#
+#  Caution: This module requires additional review when modified.
+#  This library will have external input - signature.
+#  This external input must be validated carefully to avoid security issues such as
+#  buffer overflow or integer overflow.
+#
+#  Copyright (c) 2009 - 2019, Intel Corporation. All rights reserved.<BR>
+#  SPDX-License-Identifier: BSD-2-Clause-Patent
+#
+##
+
+[Defines]
+  INF_VERSION                    = 0x00010005
+  BASE_NAME                      = BaseCryptLibNull
+  MODULE_UNI_FILE                = BaseCryptLibNull.uni
+  FILE_GUID                      = ba4b5ba1-0ea1-415a-896c-6caaf32146f3
+  MODULE_TYPE                    = BASE
+  VERSION_STRING                 = 1.0
+  LIBRARY_CLASS                  = BaseCryptLib
+
+#
+# The following information is for reference only and not required by the build tools.
+#
+#  VALID_ARCHITECTURES           = IA32 X64 ARM AARCH64
+#
+
+[Sources]
+  InternalCryptLib.h
+  Hash/CryptMd4Null.c
+  Hash/CryptMd5Null.c
+  Hash/CryptSha1Null.c
+  Hash/CryptSha256Null.c
+  Hash/CryptSha512Null.c
+  Hash/CryptSm3Null.c
+  Hmac/CryptHmacMd5Null.c
+  Hmac/CryptHmacSha1Null.c
+  Hmac/CryptHmacSha256Null.c
+  Cipher/CryptAesNull.c
+  Cipher/CryptTdesNull.c
+  Cipher/CryptArc4Null.c
+  Pk/CryptRsaBasicNull.c
+  Pk/CryptRsaExtNull.c
+  Pk/CryptPkcs1OaepNull.c
+  Pk/CryptPkcs5Pbkdf2Null.c
+  Pk/CryptPkcs7SignNull.c
+  Pk/CryptPkcs7VerifyNull.c
+  Pk/CryptPkcs7VerifyEkuNull.c
+  Pk/CryptDhNull.c
+  Pk/CryptX509Null.c
+  Pk/CryptAuthenticodeNull.c
+  Pk/CryptTsNull.c
+  Pem/CryptPemNull.c
+  Rand/CryptRandNull.c
+
+[Packages]
+  MdePkg/MdePkg.dec
+  CryptoPkg/CryptoPkg.dec
+
+[LibraryClasses]
+  DebugLib
diff --git a/CryptoPkg/Library/BaseCryptLibNull/BaseCryptLibNull.uni b/CryptoPkg/Library/BaseCryptLibNull/BaseCryptLibNull.uni
new file mode 100644
index 0000000000..c86f612d74
--- /dev/null
+++ b/CryptoPkg/Library/BaseCryptLibNull/BaseCryptLibNull.uni
@@ -0,0 +1,18 @@
+// /** @file
+// Cryptographic Library Null Instance.
+//
+// Caution: This module requires additional review when modified.
+// This library will have external input - signature.
+// This external input must be validated carefully to avoid security issues such as
+// buffer overflow or integer overflow.
+//
+// Copyright (c) 2009 - 2018, Intel Corporation. All rights reserved.<BR>
+//
+// SPDX-License-Identifier: BSD-2-Clause-Patent
+//
+// **/
+
+#string STR_MODULE_ABSTRACT             #language en-US "Cryptographic Library Null Instance"
+
+#string STR_MODULE_DESCRIPTION          #language en-US "Caution: This is a null version of your crypto library and SHOULD NOT be used on any product ever."
+
diff --git a/CryptoPkg/Library/BaseCryptLibNull/Cipher/CryptAesNull.c b/CryptoPkg/Library/BaseCryptLibNull/Cipher/CryptAesNull.c
new file mode 100644
index 0000000000..a82adacf4f
--- /dev/null
+++ b/CryptoPkg/Library/BaseCryptLibNull/Cipher/CryptAesNull.c
@@ -0,0 +1,159 @@
+/** @file
+  AES Wrapper Implementation which does not provide real capabilities.
+
+Copyright (c) 2012 - 2018, Intel Corporation. All rights reserved.<BR>
+SPDX-License-Identifier: BSD-2-Clause-Patent
+
+**/
+
+#include "InternalCryptLib.h"
+
+/**
+  Retrieves the size, in bytes, of the context buffer required for AES operations.
+
+  Return zero to indicate this interface is not supported.
+
+  @retval  0   This interface is not supported.
+
+**/
+UINTN
+EFIAPI
+AesGetContextSize (
+  VOID
+  )
+{
+  ASSERT (FALSE);
+  return 0;
+}
+
+/**
+  Initializes user-supplied memory as AES context for subsequent use.
+
+  Return FALSE to indicate this interface is not supported.
+
+  @param[out]  AesContext  Pointer to AES context being initialized.
+  @param[in]   Key         Pointer to the user-supplied AES key.
+  @param[in]   KeyLength   Length of AES key in bits.
+
+  @retval FALSE  This interface is not supported.
+
+**/
+BOOLEAN
+EFIAPI
+AesInit (
+  OUT  VOID         *AesContext,
+  IN   CONST UINT8  *Key,
+  IN   UINTN        KeyLength
+  )
+{
+  ASSERT (FALSE);
+  return FALSE;
+}
+
+/**
+  Performs AES encryption on a data buffer of the specified size in ECB mode.
+
+  Return FALSE to indicate this interface is not supported.
+
+  @param[in]   AesContext  Pointer to the AES context.
+  @param[in]   Input       Pointer to the buffer containing the data to be encrypted.
+  @param[in]   InputSize   Size of the Input buffer in bytes.
+  @param[out]  Output      Pointer to a buffer that receives the AES encryption output.
+
+  @retval FALSE  This interface is not supported.
+
+**/
+BOOLEAN
+EFIAPI
+AesEcbEncrypt (
+  IN   VOID         *AesContext,
+  IN   CONST UINT8  *Input,
+  IN   UINTN        InputSize,
+  OUT  UINT8        *Output
+  )
+{
+  ASSERT (FALSE);
+  return FALSE;
+}
+
+/**
+  Performs AES decryption on a data buffer of the specified size in ECB mode.
+
+  Return FALSE to indicate this interface is not supported.
+
+  @param[in]   AesContext  Pointer to the AES context.
+  @param[in]   Input       Pointer to the buffer containing the data to be decrypted.
+  @param[in]   InputSize   Size of the Input buffer in bytes.
+  @param[out]  Output      Pointer to a buffer that receives the AES decryption output.
+
+  @retval FALSE  This interface is not supported.
+
+**/
+BOOLEAN
+EFIAPI
+AesEcbDecrypt (
+  IN   VOID         *AesContext,
+  IN   CONST UINT8  *Input,
+  IN   UINTN        InputSize,
+  OUT  UINT8        *Output
+  )
+{
+  ASSERT (FALSE);
+  return FALSE;
+}
+
+/**
+  Performs AES encryption on a data buffer of the specified size in CBC mode.
+
+  Return FALSE to indicate this interface is not supported.
+
+  @param[in]   AesContext  Pointer to the AES context.
+  @param[in]   Input       Pointer to the buffer containing the data to be encrypted.
+  @param[in]   InputSize   Size of the Input buffer in bytes.
+  @param[in]   Ivec        Pointer to initialization vector.
+  @param[out]  Output      Pointer to a buffer that receives the AES encryption output.
+
+  @retval FALSE  This interface is not supported.
+
+**/
+BOOLEAN
+EFIAPI
+AesCbcEncrypt (
+  IN   VOID         *AesContext,
+  IN   CONST UINT8  *Input,
+  IN   UINTN        InputSize,
+  IN   CONST UINT8  *Ivec,
+  OUT  UINT8        *Output
+  )
+{
+  ASSERT (FALSE);
+  return FALSE;
+}
+
+/**
+  Performs AES decryption on a data buffer of the specified size in CBC mode.
+
+  Return FALSE to indicate this interface is not supported.
+
+  @param[in]   AesContext  Pointer to the AES context.
+  @param[in]   Input       Pointer to the buffer containing the data to be encrypted.
+  @param[in]   InputSize   Size of the Input buffer in bytes.
+  @param[in]   Ivec        Pointer to initialization vector.
+  @param[out]  Output      Pointer to a buffer that receives the AES encryption output.
+
+  @retval FALSE  This interface is not supported.
+
+**/
+BOOLEAN
+EFIAPI
+AesCbcDecrypt (
+  IN   VOID         *AesContext,
+  IN   CONST UINT8  *Input,
+  IN   UINTN        InputSize,
+  IN   CONST UINT8  *Ivec,
+  OUT  UINT8        *Output
+  )
+{
+  ASSERT (FALSE);
+  return FALSE;
+}
diff --git a/CryptoPkg/Library/BaseCryptLibNull/Cipher/CryptArc4Null.c b/CryptoPkg/Library/BaseCryptLibNull/Cipher/CryptArc4Null.c
new file mode 100644
index 0000000000..1f09bfa30e
--- /dev/null
+++ b/CryptoPkg/Library/BaseCryptLibNull/Cipher/CryptArc4Null.c
@@ -0,0 +1,124 @@
+/** @file
+  ARC4 Wrapper Implementation which does not provide real capabilities.
+
+Copyright (c) 2012 - 2018, Intel Corporation. All rights reserved.<BR>
+SPDX-License-Identifier: BSD-2-Clause-Patent
+
+**/
+
+#include "InternalCryptLib.h"
+
+/**
+  Retrieves the size, in bytes, of the context buffer required for ARC4 operations.
+
+  Return zero to indicate this interface is not supported.
+
+  @retval  0   This interface is not supported.
+
+
+**/
+UINTN
+EFIAPI
+Arc4GetContextSize (
+  VOID
+  )
+{
+  ASSERT (FALSE);
+  return 0;
+}
+
+/**
+  Initializes user-supplied memory as ARC4 context for subsequent use.
+
+  Return FALSE to indicate this interface is not supported.
+
+  @param[out]  Arc4Context  Pointer to ARC4 context being initialized.
+  @param[in]   Key          Pointer to the user-supplied ARC4 key.
+  @param[in]   KeySize      Size of ARC4 key in bytes.
+
+  @retval FALSE  This interface is not supported.
+
+**/
+BOOLEAN
+EFIAPI
+Arc4Init (
+  OUT  VOID         *Arc4Context,
+  IN   CONST UINT8  *Key,
+  IN   UINTN        KeySize
+  )
+{
+  ASSERT (FALSE);
+  return FALSE;
+}
+
+/**
+  Performs ARC4 encryption on a data buffer of the specified size.
+
+  Return FALSE to indicate this interface is not supported.
+
+  @param[in, out]  Arc4Context  Pointer to the ARC4 context.
+  @param[in]       Input        Pointer to the buffer containing the data to be encrypted.
+  @param[in]       InputSize    Size of the Input buffer in bytes.
+  @param[out]      Output       Pointer to a buffer that receives the ARC4 encryption output.
+
+  @retval FALSE  This interface is not supported.
+
+**/
+BOOLEAN
+EFIAPI
+Arc4Encrypt (
+  IN OUT  VOID         *Arc4Context,
+  IN      CONST UINT8  *Input,
+  IN      UINTN        InputSize,
+  OUT     UINT8        *Output
+  )
+{
+  ASSERT (FALSE);
+  return FALSE;
+}
+
+/**
+  Performs ARC4 decryption on a data buffer of the specified size.
+
+  Return FALSE to indicate this interface is not supported.
+
+  @param[in, out]  Arc4Context  Pointer to the ARC4 context.
+  @param[in]       Input        Pointer to the buffer containing the data to be decrypted.
+  @param[in]       InputSize    Size of the Input buffer in bytes.
+  @param[out]      Output       Pointer to a buffer that receives the ARC4 decryption output.
+
+  @retval FALSE  This interface is not supported.
+
+**/
+BOOLEAN
+EFIAPI
+Arc4Decrypt (
+  IN OUT  VOID   *Arc4Context,
+  IN      UINT8  *Input,
+  IN      UINTN  InputSize,
+  OUT     UINT8  *Output
+  )
+{
+  ASSERT (FALSE);
+  return FALSE;
+}
+
+/**
+  Resets the ARC4 context to the initial state.
+
+  Return FALSE to indicate this interface is not supported.
+
+  @param[in, out]  Arc4Context  Pointer to the ARC4 context.
+
+  @retval FALSE  This interface is not supported.
+
+**/
+BOOLEAN
+EFIAPI
+Arc4Reset (
+  IN OUT  VOID  *Arc4Context
+  )
+{
+  ASSERT (FALSE);
+  return FALSE;
+}
diff --git a/CryptoPkg/Library/BaseCryptLibNull/Cipher/CryptTdesNull.c b/CryptoPkg/Library/BaseCryptLibNull/Cipher/CryptTdesNull.c
new file mode 100644
index 0000000000..efa2716063
--- /dev/null
+++ b/CryptoPkg/Library/BaseCryptLibNull/Cipher/CryptTdesNull.c
@@ -0,0 +1,160 @@
+/** @file
+  TDES Wrapper Implementation which does not provide real capabilities.
+
+Copyright (c) 2012, Intel Corporation. All rights reserved.<BR>
+SPDX-License-Identifier: BSD-2-Clause-Patent
+
+**/
+
+#include "InternalCryptLib.h"
+
+/**
+  Retrieves the size, in bytes, of the context buffer required for TDES operations.
+
+  Return zero to indicate this interface is not supported.
+
+  @retval  0   This interface is not supported.
+
+**/
+UINTN
+EFIAPI
+TdesGetContextSize (
+  VOID
+  )
+{
+  ASSERT (FALSE);
+  return 0;
+}
+
+/**
+  Initializes user-supplied memory as TDES context for subsequent use.
+
+  Return FALSE to indicate this interface is not supported.
+
+  @param[out]  TdesContext  Pointer to TDES context being initialized.
+  @param[in]   Key          Pointer to the user-supplied TDES key.
+  @param[in]   KeyLength    Length of TDES key in bits.
+
+  @retval FALSE  This interface is not supported.
+
+**/
+BOOLEAN
+EFIAPI
+TdesInit (
+  OUT  VOID         *TdesContext,
+  IN   CONST UINT8  *Key,
+  IN   UINTN        KeyLength
+  )
+{
+  ASSERT (FALSE);
+  return FALSE;
+}
+
+/**
+  Performs TDES encryption on a data buffer of the specified size in ECB mode.
+
+  Return FALSE to indicate this interface is not supported.
+
+  @param[in]   TdesContext  Pointer to the TDES context.
+  @param[in]   Input        Pointer to the buffer containing the data to be encrypted.
+  @param[in]   InputSize    Size of the Input buffer in bytes.
+  @param[out]  Output       Pointer to a buffer that receives the TDES encryption output.
+
+  @retval FALSE  This interface is not supported.
+
+**/
+BOOLEAN
+EFIAPI
+TdesEcbEncrypt (
+  IN   VOID         *TdesContext,
+  IN   CONST UINT8  *Input,
+  IN   UINTN        InputSize,
+  OUT  UINT8        *Output
+  )
+{
+  ASSERT (FALSE);
+  return FALSE;
+}
+
+/**
+  Performs TDES decryption on a data buffer of the specified size in ECB mode.
+
+  Return FALSE to indicate this interface is not supported.
+
+  @param[in]   TdesContext  Pointer to the TDES context.
+  @param[in]   Input        Pointer to the buffer containing the data to be decrypted.
+  @param[in]   InputSize    Size of the Input buffer in bytes.
+  @param[out]  Output       Pointer to a buffer that receives the TDES decryption output.
+
+  @retval FALSE  This interface is not supported.
+
+**/
+BOOLEAN
+EFIAPI
+TdesEcbDecrypt (
+  IN   VOID         *TdesContext,
+  IN   CONST UINT8  *Input,
+  IN   UINTN        InputSize,
+  OUT  UINT8        *Output
+  )
+{
+  ASSERT (FALSE);
+  return FALSE;
+}
+
+/**
+  Performs TDES encryption on a data buffer of the specified size in CBC mode.
+
+  Return FALSE to indicate this interface is not supported.
+
+  @param[in]   TdesContext  Pointer to the TDES context.
+  @param[in]   Input        Pointer to the buffer containing the data to be encrypted.
+  @param[in]   InputSize    Size of the Input buffer in bytes.
+  @param[in]   Ivec         Pointer to initialization vector.
+  @param[out]  Output       Pointer to a buffer that receives the TDES encryption output.
+
+  @retval FALSE  This interface is not supported.
+
+**/
+BOOLEAN
+EFIAPI
+TdesCbcEncrypt (
+  IN   VOID         *TdesContext,
+  IN   CONST UINT8  *Input,
+  IN   UINTN        InputSize,
+  IN   CONST UINT8  *Ivec,
+  OUT  UINT8        *Output
+  )
+{
+  ASSERT (FALSE);
+  return FALSE;
+}
+
+/**
+  Performs TDES decryption on a data buffer of the specified size in CBC mode.
+
+  Return FALSE to indicate this interface is not supported.
+
+  @param[in]   TdesContext  Pointer to the TDES context.
+  @param[in]   Input        Pointer to the buffer containing the data to be encrypted.
+  @param[in]   InputSize    Size of the Input buffer in bytes.
+  @param[in]   Ivec         Pointer to initialization vector.
+  @param[out]  Output       Pointer to a buffer that receives the TDES encryption output.
+
+  @retval FALSE  This interface is not supported.
+
+**/
+BOOLEAN
+EFIAPI
+TdesCbcDecrypt (
+  IN   VOID         *TdesContext,
+  IN   CONST UINT8  *Input,
+  IN   UINTN        InputSize,
+  IN   CONST UINT8  *Ivec,
+  OUT  UINT8        *Output
+  )
+{
+  ASSERT (FALSE);
+  return FALSE;
+}
+
diff --git a/CryptoPkg/Library/BaseCryptLibNull/Hash/CryptMd4Null.c b/CryptoPkg/Library/BaseCryptLibNull/Hash/CryptMd4Null.c
new file mode 100644
index 0000000000..610c61c713
--- /dev/null
+++ b/CryptoPkg/Library/BaseCryptLibNull/Hash/CryptMd4Null.c
@@ -0,0 +1,143 @@
+/** @file
+  MD4 Digest Wrapper Implementation which does not provide real capabilities.
+
+Copyright (c) 2012 - 2018, Intel Corporation. All rights reserved.<BR>
+SPDX-License-Identifier: BSD-2-Clause-Patent
+
+**/
+
+#include "InternalCryptLib.h"
+
+/**
+  Retrieves the size, in bytes, of the context buffer required for MD4 hash
+  operations.
+
+  Return zero to indicate this interface is not supported.
+
+  @retval  0   This interface is not supported.
+
+**/
+UINTN
+EFIAPI
+Md4GetContextSize (
+  VOID
+  )
+{
+  ASSERT (FALSE);
+  return 0;
+}
+
+/**
+  Initializes user-supplied memory pointed by Md4Context as MD4 hash context for
+  subsequent use.
+
+  Return FALSE to indicate this interface is not supported.
+
+  @param[out]  Md4Context  Pointer to MD4 context being initialized.
+
+  @retval FALSE  This interface is not supported.
+
+**/
+BOOLEAN
+EFIAPI
+Md4Init (
+  OUT  VOID  *Md4Context
+  )
+{
+  ASSERT (FALSE);
+  return FALSE;
+}
+
+/**
+  Makes a copy of an existing MD4 context.
+
+  Return FALSE to indicate this interface is not supported.
+
+  @param[in]  Md4Context     Pointer to MD4 context being copied.
+  @param[out] NewMd4Context  Pointer to new MD4 context.
+
+  @retval FALSE  This interface is not supported.
+
+**/
+BOOLEAN
+EFIAPI
+Md4Duplicate (
+  IN   CONST VOID  *Md4Context,
+  OUT  VOID        *NewMd4Context
+  )
+{
+  ASSERT (FALSE);
+  return FALSE;
+}
+
+/**
+  Digests the input data and updates MD4 context.
+
+  Return FALSE to indicate this interface is not supported.
+
+  @param[in, out]  Md4Context  Pointer to the MD4 context.
+  @param[in]       Data        Pointer to the buffer containing the data to be hashed.
+  @param[in]       DataSize    Size of Data buffer in bytes.
+
+  @retval FALSE  This interface is not supported.
+
+**/
+BOOLEAN
+EFIAPI
+Md4Update (
+  IN OUT  VOID        *Md4Context,
+  IN      CONST VOID  *Data,
+  IN      UINTN       DataSize
+  )
+{
+  ASSERT (FALSE);
+  return FALSE;
+}
+
+/**
+  Completes computation of the MD4 digest value.
+
+  Return FALSE to indicate this interface is not supported.
+
+  @param[in, out]  Md4Context  Pointer to the MD4 context.
+  @param[out]      HashValue   Pointer to a buffer that receives the MD4 digest
+                               value (16 bytes).
+
+  @retval FALSE  This interface is not supported.
+
+**/
+BOOLEAN
+EFIAPI
+Md4Final (
+  IN OUT  VOID   *Md4Context,
+  OUT     UINT8  *HashValue
+  )
+{
+  ASSERT (FALSE);
+  return FALSE;
+}
+
+/**
+  Computes the MD4 message digest of a input data buffer.
+
+  Return FALSE to indicate this interface is not supported.
+
+  @param[in]   Data        Pointer to the buffer containing the data to be hashed.
+  @param[in]   DataSize    Size of Data buffer in bytes.
+  @param[out]  HashValue   Pointer to a buffer that receives the MD4 digest
+                           value (16 bytes).
+
+  @retval FALSE  This interface is not supported.
+
+**/
+BOOLEAN
+EFIAPI
+Md4HashAll (
+  IN   CONST VOID  *Data,
+  IN   UINTN       DataSize,
+  OUT  UINT8       *HashValue
+  )
+{
+  ASSERT (FALSE);
+  return FALSE;
+}
diff --git a/CryptoPkg/Library/BaseCryptLibNull/Hash/CryptMd5Null.c b/CryptoPkg/Library/BaseCryptLibNull/Hash/CryptMd5Null.c
new file mode 100644
index 0000000000..34c539fe3a
--- /dev/null
+++ b/CryptoPkg/Library/BaseCryptLibNull/Hash/CryptMd5Null.c
@@ -0,0 +1,165 @@
+/** @file
+
+MD5 Digest Wrapper Null Implementation.
+
+Copyright (c) Microsoft Corporation. All rights reserved.
+SPDX-License-Identifier: BSD-2-Clause-Patent
+
+**/
+
+#include "InternalCryptLib.h"
+
+
+/**
+  Retrieves the size, in bytes, of the context buffer required for MD5 hash operations.
+
+  @return  The size, in bytes, of the context buffer required for MD5 hash operations.
+
+**/
+UINTN
+EFIAPI
+Md5GetContextSize (
+  VOID
+  )
+{
+  ASSERT (FALSE);
+  return 0;
+}
+
+
+/**
+  Initializes user-supplied memory pointed by Md5Context as MD5 hash context for
+  subsequent use.
+
+  If Md5Context is NULL, then return FALSE.
+
+  @param[out]  Md5Context  Pointer to MD5 context being initialized.
+
+  @retval TRUE   MD5 context initialization succeeded.
+  @retval FALSE  MD5 context initialization failed.
+
+**/
+BOOLEAN
+EFIAPI
+Md5Init (
+  OUT  VOID  *Md5Context
+  )
+{
+  ASSERT (FALSE);
+  return FALSE;
+}
+
+/**
+  Makes a copy of an existing MD5 context.
+
+  If Md5Context is NULL, then return FALSE.
+  If NewMd5Context is NULL, then return FALSE.
+
+  @param[in]  Md5Context     Pointer to MD5 context being copied.
+  @param[out] NewMd5Context  Pointer to new MD5 context.
+
+  @retval TRUE   MD5 context copy succeeded.
+  @retval FALSE  MD5 context copy failed.
+
+**/
+BOOLEAN
+EFIAPI
+Md5Duplicate (
+  IN   CONST VOID  *Md5Context,
+  OUT  VOID        *NewMd5Context
+  )
+{
+  ASSERT (FALSE);
+  return FALSE;
+}
+
+/**
+  Digests the input data and updates MD5 context.
+
+  This function performs MD5 digest on a data buffer of the specified size.
+  It can be called multiple times to compute the digest of long or discontinuous data streams.
+  MD5 context should be already correctly intialized by Md5Init(), and should not be finalized
+  by Md5Final(). Behavior with invalid context is undefined.
+
+  If Md5Context is NULL, then return FALSE.
+
+  @param[in, out]  Md5Context  Pointer to the MD5 context.
+  @param[in]       Data        Pointer to the buffer containing the data to be hashed.
+  @param[in]       DataSize    Size of Data buffer in bytes.
+
+  @retval TRUE   MD5 data digest succeeded.
+  @retval FALSE  MD5 data digest failed.
+
+**/
+BOOLEAN
+EFIAPI
+Md5Update (
+  IN OUT  VOID        *Md5Context,
+  IN      CONST VOID  *Data,
+  IN      UINTN       DataSize
+  )
+{
+  ASSERT (FALSE);
+  return FALSE;
+}
+
+/**
+  Completes computation of the MD5 digest value.
+
+  This function completes MD5 hash computation and retrieves the digest value into
+  the specified memory. After this function has been called, the MD5 context cannot
+  be used again.
+  MD5 context should be already correctly intialized by Md5Init(), and should not be
+  finalized by Md5Final(). Behavior with invalid MD5 context is undefined.
+
+  If Md5Context is NULL, then return FALSE.
+  If HashValue is NULL, then return FALSE.
+
+  @param[in, out]  Md5Context  Pointer to the MD5 context.
+  @param[out]      HashValue   Pointer to a buffer that receives the MD5 digest
+                               value (16 bytes).
+
+  @retval TRUE   MD5 digest computation succeeded.
+  @retval FALSE  MD5 digest computation failed.
+
+**/
+BOOLEAN
+EFIAPI
+Md5Final (
+  IN OUT  VOID   *Md5Context,
+  OUT     UINT8  *HashValue
+  )
+{
+  ASSERT (FALSE);
+  return FALSE;
+}
+
+/**
+Computes the MD5 message digest of a input data buffer.
+
+This function performs the MD5 message digest of a given data buffer, and places
+the digest value into the specified memory.
+
+If this interface is not supported, then return FALSE.
+
+@param[in]   Data        Pointer to the buffer containing the data to be hashed.
+@param[in]   DataSize    Size of Data buffer in bytes.
+@param[out]  HashValue   Pointer to a buffer that receives the MD5 digest
+value (16 bytes).
+
+@retval TRUE   MD5 digest computation succeeded.
+@retval FALSE  MD5 digest computation failed.
+@retval FALSE  This interface is not supported.
+
+**/
+BOOLEAN
+EFIAPI
+Md5HashAll(
+  IN   CONST VOID  *Data,
+  IN   UINTN       DataSize,
+  OUT  UINT8       *HashValue
+)
+{
+  ASSERT(FALSE);
+  return FALSE;
+}
diff --git a/CryptoPkg/Library/BaseCryptLibNull/Hash/CryptSha1Null.c b/CryptoPkg/Library/BaseCryptLibNull/Hash/CryptSha1Null.c
new file mode 100644
index 0000000000..c2f4d30f83
--- /dev/null
+++ b/CryptoPkg/Library/BaseCryptLibNull/Hash/CryptSha1Null.c
@@ -0,0 +1,167 @@
+/** @file
+  SHA-1 Digest Wrapper Null Implementation.
+
+Copyright (c) 2009 - 2016, Intel Corporation. All rights reserved.<BR>
+SPDX-License-Identifier: BSD-2-Clause-Patent
+
+**/
+
+#include "InternalCryptLib.h"
+
+
+/**
+  Retrieves the size, in bytes, of the context buffer required for SHA-1 hash operations.
+
+  @return  The size, in bytes, of the context buffer required for SHA-1 hash operations.
+
+**/
+UINTN
+EFIAPI
+Sha1GetContextSize (
+  VOID
+  )
+{
+  //
+  // Retrieves SHA Context Size
+  //
+  ASSERT (FALSE);
+  return 0;
+}
+
+/**
+  Initializes user-supplied memory pointed by Sha1Context as SHA-1 hash context for
+  subsequent use.
+
+  If Sha1Context is NULL, then return FALSE.
+
+  @param[out]  Sha1Context  Pointer to SHA-1 context being initialized.
+
+  @retval TRUE   SHA-1 context initialization succeeded.
+  @retval FALSE  SHA-1 context initialization failed.
+
+**/
+BOOLEAN
+EFIAPI
+Sha1Init (
+  OUT  VOID  *Sha1Context
+  )
+{
+  ASSERT (FALSE);
+  return FALSE;
+}
+
+/**
+  Makes a copy of an existing SHA-1 context.
+
+  If Sha1Context is NULL, then return FALSE.
+  If NewSha1Context is NULL, then return FALSE.
+
+  @param[in]  Sha1Context     Pointer to SHA-1 context being copied.
+  @param[out] NewSha1Context  Pointer to new SHA-1 context.
+
+  @retval TRUE   SHA-1 context copy succeeded.
+  @retval FALSE  SHA-1 context copy failed.
+
+**/
+BOOLEAN
+EFIAPI
+Sha1Duplicate (
+  IN   CONST VOID  *Sha1Context,
+  OUT  VOID        *NewSha1Context
+  )
+{
+  ASSERT (FALSE);
+
+  return FALSE;
+}
+
+/**
+  Digests the input data and updates SHA-1 context.
+
+  This function performs SHA-1 digest on a data buffer of the specified size.
+  It can be called multiple times to compute the digest of long or discontinuous data streams.
+  SHA-1 context should be already correctly initialized by Sha1Init(), and should not be finalized
+  by Sha1Final(). Behavior with invalid context is undefined.
+
+  If Sha1Context is NULL, then return FALSE.
+
+  @param[in, out]  Sha1Context  Pointer to the SHA-1 context.
+  @param[in]       Data         Pointer to the buffer containing the data to be hashed.
+  @param[in]       DataSize     Size of Data buffer in bytes.
+
+  @retval TRUE   SHA-1 data digest succeeded.
+  @retval FALSE  SHA-1 data digest failed.
+
+**/
+BOOLEAN
+EFIAPI
+Sha1Update (
+  IN OUT  VOID        *Sha1Context,
+  IN      CONST VOID  *Data,
+  IN      UINTN       DataSize
+  )
+{
+  ASSERT (FALSE);
+  return FALSE;
+}
+
+/**
+  Completes computation of the SHA-1 digest value.
+
+  This function completes SHA-1 hash computation and retrieves the digest value into
+  the specified memory. After this function has been called, the SHA-1 context cannot
+  be used again.
+  SHA-1 context should be already correctly initialized by Sha1Init(), and should not be
+  finalized by Sha1Final(). Behavior with invalid SHA-1 context is undefined.
+
+  If Sha1Context is NULL, then return FALSE.
+  If HashValue is NULL, then return FALSE.
+
+  @param[in, out]  Sha1Context  Pointer to the SHA-1 context.
+  @param[out]      HashValue    Pointer to a buffer that receives the SHA-1 digest
+                                value (20 bytes).
+
+  @retval TRUE   SHA-1 digest computation succeeded.
+  @retval FALSE  SHA-1 digest computation failed.
+
+**/
+BOOLEAN
+EFIAPI
+Sha1Final (
+  IN OUT  VOID   *Sha1Context,
+  OUT     UINT8  *HashValue
+  )
+{
+  ASSERT (FALSE);
+  return FALSE;
+}
+
+/**
+  Computes the SHA-1 message digest of a input data buffer.
+
+  This function performs the SHA-1 message digest of a given data buffer, and places
+  the digest value into the specified memory.
+
+  If this interface is not supported, then return FALSE.
+
+  @param[in]   Data        Pointer to the buffer containing the data to be hashed.
+  @param[in]   DataSize    Size of Data buffer in bytes.
+  @param[out]  HashValue   Pointer to a buffer that receives the SHA-1 digest
+                           value (20 bytes).
+
+  @retval TRUE   SHA-1 digest computation succeeded.
+  @retval FALSE  SHA-1 digest computation failed.
+  @retval FALSE  This interface is not supported.
+
+**/
+BOOLEAN
+EFIAPI
+Sha1HashAll (
+  IN   CONST VOID  *Data,
+  IN   UINTN       DataSize,
+  OUT  UINT8       *HashValue
+  )
+{
+  ASSERT (FALSE);
+  return FALSE;
+}
diff --git a/CryptoPkg/Library/BaseCryptLibNull/Hash/CryptSha256Null.c b/CryptoPkg/Library/BaseCryptLibNull/Hash/CryptSha256Null.c
new file mode 100644
index 0000000000..cf994e8e06
--- /dev/null
+++ b/CryptoPkg/Library/BaseCryptLibNull/Hash/CryptSha256Null.c
@@ -0,0 +1,162 @@
+/** @file
+  SHA-256 Digest Wrapper Null Implementation.
+
+Copyright (c) 2009 - 2016, Intel Corporation. All rights reserved.<BR>
+SPDX-License-Identifier: BSD-2-Clause-Patent
+
+**/
+
+#include "InternalCryptLib.h"
+
+/**
+  Retrieves the size, in bytes, of the context buffer required for SHA-256 hash operations.
+
+  @return  The size, in bytes, of the context buffer required for SHA-256 hash operations.
+
+**/
+UINTN
+EFIAPI
+Sha256GetContextSize (
+  VOID
+  )
+{
+  ASSERT (FALSE);
+  return 0;
+}
+
+/**
+  Initializes user-supplied memory pointed by Sha256Context as SHA-256 hash context for
+  subsequent use.
+
+  If Sha256Context is NULL, then return FALSE.
+
+  @param[out]  Sha256Context  Pointer to SHA-256 context being initialized.
+
+  @retval TRUE   SHA-256 context initialization succeeded.
+  @retval FALSE  SHA-256 context initialization failed.
+
+**/
+BOOLEAN
+EFIAPI
+Sha256Init (
+  OUT  VOID  *Sha256Context
+  )
+{
+  ASSERT (FALSE);
+  return FALSE;
+}
+
+/**
+  Makes a copy of an existing SHA-256 context.
+
+  If Sha256Context is NULL, then return FALSE.
+  If NewSha256Context is NULL, then return FALSE.
+
+  @param[in]  Sha256Context     Pointer to SHA-256 context being copied.
+  @param[out] NewSha256Context  Pointer to new SHA-256 context.
+
+  @retval TRUE   SHA-256 context copy succeeded.
+  @retval FALSE  SHA-256 context copy failed.
+
+**/
+BOOLEAN
+EFIAPI
+Sha256Duplicate (
+  IN   CONST VOID  *Sha256Context,
+  OUT  VOID        *NewSha256Context
+  )
+{
+  ASSERT (FALSE);
+  return FALSE;
+}
+
+/**
+  Digests the input data and updates SHA-256 context.
+
+  This function performs SHA-256 digest on a data buffer of the specified size.
+  It can be called multiple times to compute the digest of long or discontinuous data streams.
+  SHA-256 context should be already correctly initialized by Sha256Init(), and should not be finalized
+  by Sha256Final(). Behavior with invalid context is undefined.
+
+  If Sha256Context is NULL, then return FALSE.
+
+  @param[in, out]  Sha256Context  Pointer to the SHA-256 context.
+  @param[in]       Data           Pointer to the buffer containing the data to be hashed.
+  @param[in]       DataSize       Size of Data buffer in bytes.
+
+  @retval TRUE   SHA-256 data digest succeeded.
+  @retval FALSE  SHA-256 data digest failed.
+
+**/
+BOOLEAN
+EFIAPI
+Sha256Update (
+  IN OUT  VOID        *Sha256Context,
+  IN      CONST VOID  *Data,
+  IN      UINTN       DataSize
+  )
+{
+  ASSERT (FALSE);
+  return FALSE;
+}
+
+/**
+  Completes computation of the SHA-256 digest value.
+
+  This function completes SHA-256 hash computation and retrieves the digest value into
+  the specified memory. After this function has been called, the SHA-256 context cannot
+  be used again.
+  SHA-256 context should be already correctly initialized by Sha256Init(), and should not be
+  finalized by Sha256Final(). Behavior with invalid SHA-256 context is undefined.
+
+  If Sha256Context is NULL, then return FALSE.
+  If HashValue is NULL, then return FALSE.
+
+  @param[in, out]  Sha256Context  Pointer to the SHA-256 context.
+  @param[out]      HashValue      Pointer to a buffer that receives the SHA-256 digest
+                                  value (32 bytes).
+
+  @retval TRUE   SHA-256 digest computation succeeded.
+  @retval FALSE  SHA-256 digest computation failed.
+
+**/
+BOOLEAN
+EFIAPI
+Sha256Final (
+  IN OUT  VOID   *Sha256Context,
+  OUT     UINT8  *HashValue
+  )
+{
+  ASSERT (FALSE);
+  return FALSE;
+}
+
+/**
+  Computes the SHA-256 message digest of a input data buffer.
+
+  This function performs the SHA-256 message digest of a given data buffer, and places
+  the digest value into the specified memory.
+
+  If this interface is not supported, then return FALSE.
+
+  @param[in]   Data        Pointer to the buffer containing the data to be hashed.
+  @param[in]   DataSize    Size of Data buffer in bytes.
+  @param[out]  HashValue   Pointer to a buffer that receives the SHA-256 digest
+                           value (32 bytes).
+
+  @retval TRUE   SHA-256 digest computation succeeded.
+  @retval FALSE  SHA-256 digest computation failed.
+  @retval FALSE  This interface is not supported.
+
+**/
+BOOLEAN
+EFIAPI
+Sha256HashAll (
+  IN   CONST VOID  *Data,
+  IN   UINTN       DataSize,
+  OUT  UINT8       *HashValue
+  )
+{
+  ASSERT (FALSE);
+  return FALSE;
+}
diff --git a/CryptoPkg/Library/BaseCryptLibNull/Hash/CryptSha512Null.c b/CryptoPkg/Library/BaseCryptLibNull/Hash/CryptSha512Null.c
new file mode 100644
index 0000000000..a6c861d7d1
--- /dev/null
+++ b/CryptoPkg/Library/BaseCryptLibNull/Hash/CryptSha512Null.c
@@ -0,0 +1,275 @@
+/** @file
+  SHA-384 and SHA-512 Digest Wrapper Implementations which does not provide real capabilities.
+
+Copyright (c) 2014 - 2016, Intel Corporation. All rights reserved.<BR>
+SPDX-License-Identifier: BSD-2-Clause-Patent
+
+**/
+
+#include "InternalCryptLib.h"
+
+/**
+  Retrieves the size, in bytes, of the context buffer required for SHA-384 hash operations.
+
+  Return zero to indicate this interface is not supported.
+
+  @retval  0   This interface is not supported.
+
+**/
+UINTN
+EFIAPI
+Sha384GetContextSize (
+  VOID
+  )
+{
+  ASSERT (FALSE);
+  return 0;
+}
+
+/**
+  Initializes user-supplied memory pointed by Sha384Context as SHA-384 hash context for
+  subsequent use.
+
+  Return FALSE to indicate this interface is not supported.
+
+  @param[out]  Sha384Context  Pointer to SHA-384 context being initialized.
+
+  @retval FALSE  This interface is not supported.
+
+**/
+BOOLEAN
+EFIAPI
+Sha384Init (
+  OUT  VOID  *Sha384Context
+  )
+{
+  ASSERT (FALSE);
+  return FALSE;
+}
+
+/**
+  Makes a copy of an existing SHA-384 context.
+
+  Return FALSE to indicate this interface is not supported.
+
+  @param[in]  Sha384Context     Pointer to SHA-384 context being copied.
+  @param[out] NewSha384Context  Pointer to new SHA-384 context.
+
+  @retval FALSE  This interface is not supported.
+
+**/
+BOOLEAN
+EFIAPI
+Sha384Duplicate (
+  IN   CONST VOID  *Sha384Context,
+  OUT  VOID        *NewSha384Context
+  )
+{
+  ASSERT (FALSE);
+  return FALSE;
+}
+
+/**
+  Digests the input data and updates SHA-384 context.
+
+  Return FALSE to indicate this interface is not supported.
+
+  @param[in, out]  Sha384Context  Pointer to the SHA-384 context.
+  @param[in]       Data           Pointer to the buffer containing the data to be hashed.
+  @param[in]       DataSize       Size of Data buffer in bytes.
+
+  @retval FALSE  This interface is not supported.
+
+**/
+BOOLEAN
+EFIAPI
+Sha384Update (
+  IN OUT  VOID        *Sha384Context,
+  IN      CONST VOID  *Data,
+  IN      UINTN       DataSize
+  )
+{
+  ASSERT (FALSE);
+  return FALSE;
+}
+
+/**
+  Completes computation of the SHA-384 digest value.
+
+  Return FALSE to indicate this interface is not supported.
+
+  @param[in, out]  Sha384Context  Pointer to the SHA-384 context.
+  @param[out]      HashValue      Pointer to a buffer that receives the SHA-384 digest
+                                  value (48 bytes).
+
+  @retval FALSE  This interface is not supported.
+
+**/
+BOOLEAN
+EFIAPI
+Sha384Final (
+  IN OUT  VOID   *Sha384Context,
+  OUT     UINT8  *HashValue
+  )
+{
+  ASSERT (FALSE);
+  return FALSE;
+}
+
+/**
+  Computes the SHA-384 message digest of a input data buffer.
+
+  Return FALSE to indicate this interface is not supported.
+
+  @param[in]   Data        Pointer to the buffer containing the data to be hashed.
+  @param[in]   DataSize    Size of Data buffer in bytes.
+  @param[out]  HashValue   Pointer to a buffer that receives the SHA-384 digest
+                           value (48 bytes).
+
+  @retval FALSE  This interface is not supported.
+
+**/
+BOOLEAN
+EFIAPI
+Sha384HashAll (
+  IN   CONST VOID  *Data,
+  IN   UINTN       DataSize,
+  OUT  UINT8       *HashValue
+  )
+{
+  ASSERT (FALSE);
+  return FALSE;
+}
+
+/**
+  Retrieves the size, in bytes, of the context buffer required for SHA-512 hash operations.
+
+  Return zero to indicate this interface is not supported.
+
+  @retval  0   This interface is not supported.
+
+**/
+UINTN
+EFIAPI
+Sha512GetContextSize (
+  VOID
+  )
+{
+  ASSERT (FALSE);
+  return 0;
+}
+
+/**
+  Initializes user-supplied memory pointed by Sha512Context as SHA-512 hash context for
+  subsequent use.
+
+  Return FALSE to indicate this interface is not supported.
+
+  @param[out]  Sha512Context  Pointer to SHA-512 context being initialized.
+
+  @retval FALSE  This interface is not supported.
+
+**/
+BOOLEAN
+EFIAPI
+Sha512Init (
+  OUT  VOID  *Sha512Context
+  )
+{
+  ASSERT (FALSE);
+  return FALSE;
+}
+
+/**
+  Makes a copy of an existing SHA-512 context.
+
+  Return FALSE to indicate this interface is not supported.
+
+  @param[in]  Sha512Context     Pointer to SHA-512 context being copied.
+  @param[out] NewSha512Context  Pointer to new SHA-512 context.
+
+  @retval FALSE  This interface is not supported.
+
+**/
+BOOLEAN
+EFIAPI
+Sha512Duplicate (
+  IN   CONST VOID  *Sha512Context,
+  OUT  VOID        *NewSha512Context
+  )
+{
+  ASSERT (FALSE);
+  return FALSE;
+}
+
+/**
+  Digests the input data and updates SHA-512 context.
+
+  Return FALSE to indicate this interface is not supported.
+
+  @param[in, out]  Sha512Context  Pointer to the SHA-512 context.
+  @param[in]       Data           Pointer to the buffer containing the data to be hashed.
+  @param[in]       DataSize       Size of Data buffer in bytes.
+
+  @retval FALSE  This interface is not supported.
+
+**/
+BOOLEAN
+EFIAPI
+Sha512Update (
+  IN OUT  VOID        *Sha512Context,
+  IN      CONST VOID  *Data,
+  IN      UINTN       DataSize
+  )
+{
+  ASSERT (FALSE);
+  return FALSE;
+}
+
+/**
+  Completes computation of the SHA-512 digest value.
+
+  Return FALSE to indicate this interface is not supported.
+
+  @param[in, out]  Sha512Context  Pointer to the SHA-512 context.
+  @param[out]      HashValue      Pointer to a buffer that receives the SHA-512 digest
+                                  value (64 bytes).
+
+  @retval FALSE  This interface is not supported.
+
+**/
+BOOLEAN
+EFIAPI
+Sha512Final (
+  IN OUT  VOID   *Sha512Context,
+  OUT     UINT8  *HashValue
+  )
+{
+  ASSERT (FALSE);
+  return FALSE;
+}
+
+/**
+  Computes the SHA-512 message digest of a input data buffer.
+
+  Return FALSE to indicate this interface is not supported.
+
+  @param[in]   Data        Pointer to the buffer containing the data to be hashed.
+  @param[in]   DataSize    Size of Data buffer in bytes.
+  @param[out]  HashValue   Pointer to a buffer that receives the SHA-512 digest
+                           value (64 bytes).
+
+  @retval FALSE  This interface is not supported.
+
+**/
+BOOLEAN
+EFIAPI
+Sha512HashAll (
+  IN   CONST VOID  *Data,
+  IN   UINTN       DataSize,
+  OUT  UINT8       *HashValue
+  )
+{
+  ASSERT (FALSE);
+  return FALSE;
+}
diff --git a/CryptoPkg/Library/BaseCryptLibNull/Hash/CryptSm3Null.c b/CryptoPkg/Library/BaseCryptLibNull/Hash/CryptSm3Null.c
new file mode 100644
index 0000000000..0f3c89b465
--- /dev/null
+++ b/CryptoPkg/Library/BaseCryptLibNull/Hash/CryptSm3Null.c
@@ -0,0 +1,164 @@
+/** @file
+  SM3 Digest Wrapper Null Implementation.
+
+Copyright (c) 2019, Intel Corporation. All rights reserved.<BR>
+SPDX-License-Identifier: BSD-2-Clause-Patent
+
+**/
+
+#include "InternalCryptLib.h"
+
+/**
+  Retrieves the size, in bytes, of the context buffer required for SM3 hash operations.
+
+  @return  The size, in bytes, of the context buffer required for SM3 hash operations.
+
+**/
+UINTN
+EFIAPI
+Sm3GetContextSize (
+  VOID
+  )
+{
+  ASSERT (FALSE);
+  return 0;
+}
+
+/**
+  Initializes user-supplied memory pointed by Sm3Context as SM3 hash context for
+  subsequent use.
+
+  If Sm3Context is NULL, then return FALSE.
+
+  @param[out]  Sm3Context  Pointer to SM3 context being initialized.
+
+  @retval TRUE   SM3 context initialization succeeded.
+  @retval FALSE  SM3 context initialization failed.
+
+**/
+BOOLEAN
+EFIAPI
+Sm3Init (
+  OUT  VOID  *Sm3Context
+  )
+{
+  ASSERT (FALSE);
+  return FALSE;
+}
+
+/**
+  Makes a copy of an existing SM3 context.
+
+  If Sm3Context is NULL, then return FALSE.
+  If NewSm3Context is NULL, then return FALSE.
+  If this interface is not supported, then return FALSE.
+
+  @param[in]  Sm3Context     Pointer to SM3 context being copied.
+  @param[out] NewSm3Context  Pointer to new SM3 context.
+
+  @retval TRUE   SM3 context copy succeeded.
+  @retval FALSE  SM3 context copy failed.
+  @retval FALSE  This interface is not supported.
+
+**/
+BOOLEAN
+EFIAPI
+Sm3Duplicate (
+  IN   CONST VOID  *Sm3Context,
+  OUT  VOID        *NewSm3Context
+  )
+{
+  ASSERT (FALSE);
+  return FALSE;
+}
+
+/**
+  Digests the input data and updates SM3 context.
+
+  This function performs SM3 digest on a data buffer of the specified size.
+  It can be called multiple times to compute the digest of long or discontinuous data streams.
+  SM3 context should be already correctly initialized by Sm3Init(), and should not be finalized
+  by Sm3Final(). Behavior with invalid context is undefined.
+
+  If Sm3Context is NULL, then return FALSE.
+
+  @param[in, out]  Sm3Context     Pointer to the SM3 context.
+  @param[in]       Data           Pointer to the buffer containing the data to be hashed.
+  @param[in]       DataSize       Size of Data buffer in bytes.
+
+  @retval TRUE   SM3 data digest succeeded.
+  @retval FALSE  SM3 data digest failed.
+
+**/
+BOOLEAN
+EFIAPI
+Sm3Update (
+  IN OUT  VOID        *Sm3Context,
+  IN      CONST VOID  *Data,
+  IN      UINTN       DataSize
+  )
+{
+  ASSERT (FALSE);
+  return FALSE;
+}
+
+/**
+  Completes computation of the SM3 digest value.
+
+  This function completes SM3 hash computation and retrieves the digest value into
+  the specified memory. After this function has been called, the SM3 context cannot
+  be used again.
+  SM3 context should be already correctly initialized by Sm3Init(), and should not be
+  finalized by Sm3Final(). Behavior with invalid SM3 context is undefined.
+
+  If Sm3Context is NULL, then return FALSE.
+  If HashValue is NULL, then return FALSE.
+
+  @param[in, out]  Sm3Context     Pointer to the SM3 context.
+  @param[out]      HashValue      Pointer to a buffer that receives the SM3 digest
+                                  value (32 bytes).
+
+  @retval TRUE   SM3 digest computation succeeded.
+  @retval FALSE  SM3 digest computation failed.
+
+**/
+BOOLEAN
+EFIAPI
+Sm3Final (
+  IN OUT  VOID   *Sm3Context,
+  OUT     UINT8  *HashValue
+  )
+{
+  ASSERT (FALSE);
+  return FALSE;
+}
+
+/**
+  Computes the SM3 message digest of a input data buffer.
+
+  This function performs the SM3 message digest of a given data buffer, and places
+  the digest value into the specified memory.
+
+  If this interface is not supported, then return FALSE.
+
+  @param[in]   Data        Pointer to the buffer containing the data to be hashed.
+  @param[in]   DataSize    Size of Data buffer in bytes.
+  @param[out]  HashValue   Pointer to a buffer that receives the SM3 digest
+                           value (32 bytes).
+
+  @retval TRUE   SM3 digest computation succeeded.
+  @retval FALSE  SM3 digest computation failed.
+  @retval FALSE  This interface is not supported.
+
+**/
+BOOLEAN
+EFIAPI
+Sm3HashAll (
+  IN   CONST VOID  *Data,
+  IN   UINTN       DataSize,
+  OUT  UINT8       *HashValue
+  )
+{
+  ASSERT (FALSE);
+  return FALSE;
+}
diff --git a/CryptoPkg/Library/BaseCryptLibNull/Hmac/CryptHmacMd5Null.c b/CryptoPkg/Library/BaseCryptLibNull/Hmac/CryptHmacMd5Null.c
new file mode 100644
index 0000000000..3aafed874b
--- /dev/null
+++ b/CryptoPkg/Library/BaseCryptLibNull/Hmac/CryptHmacMd5Null.c
@@ -0,0 +1,159 @@
+/** @file
+  HMAC-MD5 Wrapper Implementation which does not provide real capabilities.
+
+Copyright (c) 2012 - 2018, Intel Corporation. All rights reserved.<BR>
+SPDX-License-Identifier: BSD-2-Clause-Patent
+
+**/
+
+#include "InternalCryptLib.h"
+
+/**
+  Retrieves the size, in bytes, of the context buffer required for HMAC-MD5 operations.
+  (NOTE: This API is deprecated.
+         Use HmacMd5New() / HmacMd5Free() for HMAC-MD5 Context operations.)
+
+  Return zero to indicate this interface is not supported.
+
+  @retval  0   This interface is not supported.
+
+**/
+UINTN
+EFIAPI
+HmacMd5GetContextSize (
+  VOID
+  )
+{
+  ASSERT (FALSE);
+  return 0;
+}
+
+/**
+  Allocates and initializes one HMAC_CTX context for subsequent HMAC-MD5 use.
+
+  Return NULL to indicate this interface is not supported.
+
+  @retval NULL  This interface is not supported.
+
+**/
+VOID *
+EFIAPI
+HmacMd5New (
+  VOID
+  )
+{
+  ASSERT (FALSE);
+  return NULL;
+}
+
+/**
+  Release the specified HMAC_CTX context.
+
+  This function will do nothing.
+
+  @param[in]  HmacMd5Ctx  Pointer to the HMAC_CTX context to be released.
+
+**/
+VOID
+EFIAPI
+HmacMd5Free (
+  IN  VOID  *HmacMd5Ctx
+  )
+{
+  ASSERT (FALSE);
+  return;
+}
+
+/**
+  Initializes user-supplied memory pointed by HmacMd5Context as HMAC-MD5 context for
+  subsequent use.
+
+  Return FALSE to indicate this interface is not supported.
+
+  @param[out]  HmacMd5Context  Pointer to HMAC-MD5 context being initialized.
+  @param[in]   Key             Pointer to the user-supplied key.
+  @param[in]   KeySize         Key size in bytes.
+
+  @retval FALSE  This interface is not supported.
+
+**/
+BOOLEAN
+EFIAPI
+HmacMd5Init (
+  OUT  VOID         *HmacMd5Context,
+  IN   CONST UINT8  *Key,
+  IN   UINTN        KeySize
+  )
+{
+  ASSERT (FALSE);
+  return FALSE;
+}
+
+/**
+  Makes a copy of an existing HMAC-MD5 context.
+
+  Return FALSE to indicate this interface is not supported.
+
+  @param[in]  HmacMd5Context     Pointer to HMAC-MD5 context being copied.
+  @param[out] NewHmacMd5Context  Pointer to new HMAC-MD5 context.
+
+  @retval FALSE  This interface is not supported.
+
+**/
+BOOLEAN
+EFIAPI
+HmacMd5Duplicate (
+  IN   CONST VOID  *HmacMd5Context,
+  OUT  VOID        *NewHmacMd5Context
+  )
+{
+  ASSERT (FALSE);
+  return FALSE;
+}
+
+/**
+  Digests the input data and updates HMAC-MD5 context.
+
+  Return FALSE to indicate this interface is not supported.
+
+  @param[in, out]  HmacMd5Context  Pointer to the HMAC-MD5 context.
+  @param[in]       Data            Pointer to the buffer containing the data to be digested.
+  @param[in]       DataSize        Size of Data buffer in bytes.
+
+  @retval FALSE  This interface is not supported.
+
+**/
+BOOLEAN
+EFIAPI
+HmacMd5Update (
+  IN OUT  VOID        *HmacMd5Context,
+  IN      CONST VOID  *Data,
+  IN      UINTN       DataSize
+  )
+{
+  ASSERT (FALSE);
+  return FALSE;
+}
+
+/**
+  Completes computation of the HMAC-MD5 digest value.
+
+  Return FALSE to indicate this interface is not supported.
+
+  @param[in, out]  HmacMd5Context  Pointer to the HMAC-MD5 context.
+  @param[out]      HmacValue       Pointer to a buffer that receives the HMAC-MD5 digest
+                                   value (16 bytes).
+
+  @retval FALSE  This interface is not supported.
+
+**/
+BOOLEAN
+EFIAPI
+HmacMd5Final (
+  IN OUT  VOID   *HmacMd5Context,
+  OUT     UINT8  *HmacValue
+  )
+{
+  ASSERT (FALSE);
+  return FALSE;
+}
diff --git a/CryptoPkg/Library/BaseCryptLibNull/Hmac/CryptHmacSha1Null.c b/CryptoPkg/Library/BaseCryptLibNull/Hmac/CryptHmacSha1Null.c
new file mode 100644
index 0000000000..547aa484ea
--- /dev/null
+++ b/CryptoPkg/Library/BaseCryptLibNull/Hmac/CryptHmacSha1Null.c
@@ -0,0 +1,159 @@
+/** @file
+  HMAC-SHA1 Wrapper Implementation which does not provide real capabilities.
+
+Copyright (c) 2012 - 2018, Intel Corporation. All rights reserved.<BR>
+SPDX-License-Identifier: BSD-2-Clause-Patent
+
+**/
+
+#include "InternalCryptLib.h"
+
+/**
+  Retrieves the size, in bytes, of the context buffer required for HMAC-SHA1 operations.
+  (NOTE: This API is deprecated.
+         Use HmacSha1New() / HmacSha1Free() for HMAC-SHA1 Context operations.)
+
+  Return zero to indicate this interface is not supported.
+
+  @retval  0   This interface is not supported.
+
+**/
+UINTN
+EFIAPI
+HmacSha1GetContextSize (
+  VOID
+  )
+{
+  ASSERT (FALSE);
+  return 0;
+}
+
+/**
+  Allocates and initializes one HMAC_CTX context for subsequent HMAC-SHA1 use.
+
+  Return NULL to indicate this interface is not supported.
+
+  @return  NULL  This interface is not supported..
+
+**/
+VOID *
+EFIAPI
+HmacSha1New (
+  VOID
+  )
+{
+  ASSERT (FALSE);
+  return NULL;
+}
+
+/**
+  Release the specified HMAC_CTX context.
+
+  This function will do nothing.
+
+  @param[in]  HmacSha1Ctx  Pointer to the HMAC_CTX context to be released.
+
+**/
+VOID
+EFIAPI
+HmacSha1Free (
+  IN  VOID  *HmacSha1Ctx
+  )
+{
+  ASSERT (FALSE);
+  return;
+}
+
+/**
+  Initializes user-supplied memory pointed by HmacSha1Context as HMAC-SHA1 context for
+  subsequent use.
+
+  Return FALSE to indicate this interface is not supported.
+
+  @param[out]  HmacSha1Context  Pointer to HMAC-SHA1 context being initialized.
+  @param[in]   Key              Pointer to the user-supplied key.
+  @param[in]   KeySize          Key size in bytes.
+
+  @retval FALSE  This interface is not supported.
+
+**/
+BOOLEAN
+EFIAPI
+HmacSha1Init (
+  OUT  VOID         *HmacSha1Context,
+  IN   CONST UINT8  *Key,
+  IN   UINTN        KeySize
+  )
+{
+  ASSERT (FALSE);
+  return FALSE;
+}
+
+/**
+  Makes a copy of an existing HMAC-SHA1 context.
+
+  Return FALSE to indicate this interface is not supported.
+
+  @param[in]  HmacSha1Context     Pointer to HMAC-SHA1 context being copied.
+  @param[out] NewHmacSha1Context  Pointer to new HMAC-SHA1 context.
+
+  @retval FALSE  This interface is not supported.
+
+**/
+BOOLEAN
+EFIAPI
+HmacSha1Duplicate (
+  IN   CONST VOID  *HmacSha1Context,
+  OUT  VOID        *NewHmacSha1Context
+  )
+{
+  ASSERT (FALSE);
+  return FALSE;
+}
+
+/**
+  Digests the input data and updates HMAC-SHA1 context.
+
+  Return FALSE to indicate this interface is not supported.
+
+  @param[in, out]  HmacSha1Context Pointer to the HMAC-SHA1 context.
+  @param[in]       Data            Pointer to the buffer containing the data to be digested.
+  @param[in]       DataSize        Size of Data buffer in bytes.
+
+  @retval FALSE  This interface is not supported.
+
+**/
+BOOLEAN
+EFIAPI
+HmacSha1Update (
+  IN OUT  VOID        *HmacSha1Context,
+  IN      CONST VOID  *Data,
+  IN      UINTN       DataSize
+  )
+{
+  ASSERT (FALSE);
+  return FALSE;
+}
+
+/**
+  Completes computation of the HMAC-SHA1 digest value.
+
+  Return FALSE to indicate this interface is not supported.
+
+  @param[in, out]  HmacSha1Context  Pointer to the HMAC-SHA1 context.
+  @param[out]      HmacValue        Pointer to a buffer that receives the HMAC-SHA1 digest
+                                    value (20 bytes).
+
+  @retval FALSE  This interface is not supported.
+
+**/
+BOOLEAN
+EFIAPI
+HmacSha1Final (
+  IN OUT  VOID   *HmacSha1Context,
+  OUT     UINT8  *HmacValue
+  )
+{
+  ASSERT (FALSE);
+  return FALSE;
+}
diff --git a/CryptoPkg/Library/BaseCryptLibNull/Hmac/CryptHmacSha256Null.c b/CryptoPkg/Library/BaseCryptLibNull/Hmac/CryptHmacSha256Null.c
new file mode 100644
index 0000000000..f0a4420e27
--- /dev/null
+++ b/CryptoPkg/Library/BaseCryptLibNull/Hmac/CryptHmacSha256Null.c
@@ -0,0 +1,159 @@
+/** @file
+  HMAC-SHA256 Wrapper Implementation which does not provide real capabilities.
+
+Copyright (c) 2016 - 2017, Intel Corporation. All rights reserved.<BR>
+SPDX-License-Identifier: BSD-2-Clause-Patent
+
+**/
+
+#include "InternalCryptLib.h"
+
+/**
+  Retrieves the size, in bytes, of the context buffer required for HMAC-SHA256 operations.
+  (NOTE: This API is deprecated.
+         Use HmacSha256New() / HmacSha256Free() for HMAC-SHA256 Context operations.)
+
+  Return zero to indicate this interface is not supported.
+
+  @retval  0   This interface is not supported.
+
+**/
+UINTN
+EFIAPI
+HmacSha256GetContextSize (
+  VOID
+  )
+{
+  ASSERT (FALSE);
+  return 0;
+}
+
+/**
+  Allocates and initializes one HMAC_CTX context for subsequent HMAC-SHA256 use.
+
+  Return NULL to indicate this interface is not supported.
+
+  @return  NULL  This interface is not supported..
+
+**/
+VOID *
+EFIAPI
+HmacSha256New (
+  VOID
+  )
+{
+  ASSERT (FALSE);
+  return NULL;
+}
+
+/**
+  Release the specified HMAC_CTX context.
+
+  This function will do nothing.
+
+  @param[in]  HmacSha256Ctx  Pointer to the HMAC_CTX context to be released.
+
+**/
+VOID
+EFIAPI
+HmacSha256Free (
+  IN  VOID  *HmacSha256Ctx
+  )
+{
+  ASSERT (FALSE);
+  return;
+}
+
+/**
+  Initializes user-supplied memory pointed by HmacSha256Context as HMAC-SHA256 context for
+  subsequent use.
+
+  Return FALSE to indicate this interface is not supported.
+
+  @param[out]  HmacSha256Context  Pointer to HMAC-SHA256 context being initialized.
+  @param[in]   Key                Pointer to the user-supplied key.
+  @param[in]   KeySize            Key size in bytes.
+
+  @retval FALSE  This interface is not supported.
+
+**/
+BOOLEAN
+EFIAPI
+HmacSha256Init (
+  OUT  VOID         *HmacSha256Context,
+  IN   CONST UINT8  *Key,
+  IN   UINTN        KeySize
+  )
+{
+  ASSERT (FALSE);
+  return FALSE;
+}
+
+/**
+  Makes a copy of an existing HMAC-SHA256 context.
+
+  Return FALSE to indicate this interface is not supported.
+
+  @param[in]  HmacSha256Context     Pointer to HMAC-SHA256 context being copied.
+  @param[out] NewHmacSha256Context  Pointer to new HMAC-SHA256 context.
+
+  @retval FALSE  This interface is not supported.
+
+**/
+BOOLEAN
+EFIAPI
+HmacSha256Duplicate (
+  IN   CONST VOID  *HmacSha256Context,
+  OUT  VOID        *NewHmacSha256Context
+  )
+{
+  ASSERT (FALSE);
+  return FALSE;
+}
+
+/**
+  Digests the input data and updates HMAC-SHA256 context.
+
+  Return FALSE to indicate this interface is not supported.
+
+  @param[in, out]  HmacSha256Context Pointer to the HMAC-SHA256 context.
+  @param[in]       Data              Pointer to the buffer containing the data to be digested.
+  @param[in]       DataSize          Size of Data buffer in bytes.
+
+  @retval FALSE  This interface is not supported.
+
+**/
+BOOLEAN
+EFIAPI
+HmacSha256Update (
+  IN OUT  VOID        *HmacSha256Context,
+  IN      CONST VOID  *Data,
+  IN      UINTN       DataSize
+  )
+{
+  ASSERT (FALSE);
+  return FALSE;
+}
+
+/**
+  Completes computation of the HMAC-SHA256 digest value.
+
+  Return FALSE to indicate this interface is not supported.
+
+  @param[in, out]  HmacSha256Context  Pointer to the HMAC-SHA256 context.
+  @param[out]      HmacValue          Pointer to a buffer that receives the HMAC-SHA256 digest
+                                      value (32 bytes).
+
+  @retval FALSE  This interface is not supported.
+
+**/
+BOOLEAN
+EFIAPI
+HmacSha256Final (
+  IN OUT  VOID   *HmacSha256Context,
+  OUT     UINT8  *HmacValue
+  )
+{
+  ASSERT (FALSE);
+  return FALSE;
+}
diff --git a/CryptoPkg/Library/BaseCryptLibNull/InternalCryptLib.h b/CryptoPkg/Library/BaseCryptLibNull/InternalCryptLib.h
new file mode 100644
index 0000000000..96958592e1
--- /dev/null
+++ b/CryptoPkg/Library/BaseCryptLibNull/InternalCryptLib.h
@@ -0,0 +1,16 @@
+/** @file
+  Internal include file for BaseCryptLibNull.
+
+Copyright (c) 2010 - 2017, Intel Corporation. All rights reserved.<BR>
+SPDX-License-Identifier: BSD-2-Clause-Patent
+
+**/
+
+#ifndef __INTERNAL_CRYPT_LIB_H__
+#define __INTERNAL_CRYPT_LIB_H__
+
+#include <Base.h>
+#include <Library/BaseCryptLib.h>
+#include <Library/DebugLib.h>
+
+#endif
diff --git a/CryptoPkg/Library/BaseCryptLibNull/Pem/CryptPemNull.c b/CryptoPkg/Library/BaseCryptLibNull/Pem/CryptPemNull.c
new file mode 100644
index 0000000000..4eeabd91ad
--- /dev/null
+++ b/CryptoPkg/Library/BaseCryptLibNull/Pem/CryptPemNull.c
@@ -0,0 +1,38 @@
+/** @file
+  PEM (Privacy Enhanced Mail) Format Handler Wrapper Implementation which does
+  not provide real capabilities.
+
+Copyright (c) 2012, Intel Corporation. All rights reserved.<BR>
+SPDX-License-Identifier: BSD-2-Clause-Patent
+
+**/
+
+#include "InternalCryptLib.h"
+
+/**
+  Retrieve the RSA Private Key from the password-protected PEM key data.
+
+  Return FALSE to indicate this interface is not supported.
+
+  @param[in]  PemData      Pointer to the PEM-encoded key data to be retrieved.
+  @param[in]  PemSize      Size of the PEM key data in bytes.
+  @param[in]  Password     NULL-terminated passphrase used for encrypted PEM key data.
+  @param[out] RsaContext   Pointer to new-generated RSA context which contain the retrieved
+                           RSA private key component. Use RsaFree() function to free the
+                           resource.
+
+  @retval FALSE  This interface is not supported.
+
+**/
+BOOLEAN
+EFIAPI
+RsaGetPrivateKeyFromPem (
+  IN   CONST UINT8  *PemData,
+  IN   UINTN        PemSize,
+  IN   CONST CHAR8  *Password,
+  OUT  VOID         **RsaContext
+  )
+{
+  ASSERT (FALSE);
+  return FALSE;
+}
diff --git a/CryptoPkg/Library/BaseCryptLibNull/Pk/CryptAuthenticodeNull.c b/CryptoPkg/Library/BaseCryptLibNull/Pk/CryptAuthenticodeNull.c
new file mode 100644
index 0000000000..62e8400c4c
--- /dev/null
+++ b/CryptoPkg/Library/BaseCryptLibNull/Pk/CryptAuthenticodeNull.c
@@ -0,0 +1,45 @@
+/** @file
+  Authenticode Portable Executable Signature Verification which does not provide
+  real capabilities.
+
+Copyright (c) 2012, Intel Corporation. All rights reserved.<BR>
+SPDX-License-Identifier: BSD-2-Clause-Patent
+
+**/
+
+#include "InternalCryptLib.h"
+
+/**
+  Verifies the validity of a PE/COFF Authenticode Signature as described in "Windows
+  Authenticode Portable Executable Signature Format".
+
+  Return FALSE to indicate this interface is not supported.
+
+  @param[in]  AuthData     Pointer to the Authenticode Signature retrieved from signed
+                           PE/COFF image to be verified.
+  @param[in]  DataSize     Size of the Authenticode Signature in bytes.
+  @param[in]  TrustedCert  Pointer to a trusted/root certificate encoded in DER, which
+                           is used for certificate chain verification.
+  @param[in]  CertSize     Size of the trusted certificate in bytes.
+  @param[in]  ImageHash    Pointer to the original image file hash value. The procedure
+                           for calculating the image hash value is described in Authenticode
+                           specification.
+  @param[in]  HashSize     Size of Image hash value in bytes.
+
+  @retval FALSE  This interface is not supported.
+
+**/
+BOOLEAN
+EFIAPI
+AuthenticodeVerify (
+  IN  CONST UINT8  *AuthData,
+  IN  UINTN        DataSize,
+  IN  CONST UINT8  *TrustedCert,
+  IN  UINTN        CertSize,
+  IN  CONST UINT8  *ImageHash,
+  IN  UINTN        HashSize
+  )
+{
+  ASSERT (FALSE);
+  return FALSE;
+}
diff --git a/CryptoPkg/Library/BaseCryptLibNull/Pk/CryptDhNull.c b/CryptoPkg/Library/BaseCryptLibNull/Pk/CryptDhNull.c
new file mode 100644
index 0000000000..8987084122
--- /dev/null
+++ b/CryptoPkg/Library/BaseCryptLibNull/Pk/CryptDhNull.c
@@ -0,0 +1,150 @@
+/** @file
+  Diffie-Hellman Wrapper Implementation which does not provide
+  real capabilities.
+
+Copyright (c) 2012 - 2018, Intel Corporation. All rights reserved.<BR>
+SPDX-License-Identifier: BSD-2-Clause-Patent
+
+**/
+
+#include "InternalCryptLib.h"
+
+/**
+  Allocates and Initializes one Diffie-Hellman Context for subsequent use.
+
+  @return  Pointer to the Diffie-Hellman Context that has been initialized.
+           If the interface is not supported, DhNew() returns NULL.
+
+**/
+VOID *
+EFIAPI
+DhNew (
+  VOID
+  )
+{
+  ASSERT (FALSE);
+  return NULL;
+}
+
+/**
+  Release the specified DH context.
+
+  If the interface is not supported, then ASSERT().
+
+  @param[in]  DhContext  Pointer to the DH context to be released.
+
+**/
+VOID
+EFIAPI
+DhFree (
+  IN  VOID  *DhContext
+  )
+{
+  ASSERT (FALSE);
+}
+
+/**
+  Generates DH parameter.
+
+  Return FALSE to indicate this interface is not supported.
+
+  @param[in, out]  DhContext    Pointer to the DH context.
+  @param[in]       Generator    Value of generator.
+  @param[in]       PrimeLength  Length in bits of prime to be generated.
+  @param[out]      Prime        Pointer to the buffer to receive the generated prime number.
+
+  @retval FALSE  This interface is not supported.
+
+**/
+BOOLEAN
+EFIAPI
+DhGenerateParameter (
+  IN OUT  VOID   *DhContext,
+  IN      UINTN  Generator,
+  IN      UINTN  PrimeLength,
+  OUT     UINT8  *Prime
+  )
+{
+  ASSERT (FALSE);
+  return FALSE;
+}
+
+/**
+  Sets generator and prime parameters for DH.
+
+  Return FALSE to indicate this interface is not supported.
+
+  @param[in, out]  DhContext    Pointer to the DH context.
+  @param[in]       Generator    Value of generator.
+  @param[in]       PrimeLength  Length in bits of prime to be generated.
+  @param[in]       Prime        Pointer to the prime number.
+
+  @retval FALSE  This interface is not supported.
+
+**/
+BOOLEAN
+EFIAPI
+DhSetParameter (
+  IN OUT  VOID         *DhContext,
+  IN      UINTN        Generator,
+  IN      UINTN        PrimeLength,
+  IN      CONST UINT8  *Prime
+  )
+{
+  ASSERT (FALSE);
+  return FALSE;
+}
+
+/**
+  Generates DH public key.
+
+  Return FALSE to indicate this interface is not supported.
+
+  @param[in, out]  DhContext      Pointer to the DH context.
+  @param[out]      PublicKey      Pointer to the buffer to receive generated public key.
+  @param[in, out]  PublicKeySize  On input, the size of PublicKey buffer in bytes.
+                                  On output, the size of data returned in PublicKey buffer in bytes.
+
+  @retval FALSE  This interface is not supported.
+
+**/
+BOOLEAN
+EFIAPI
+DhGenerateKey (
+  IN OUT  VOID   *DhContext,
+  OUT     UINT8  *PublicKey,
+  IN OUT  UINTN  *PublicKeySize
+  )
+{
+  ASSERT (FALSE);
+  return FALSE;
+}
+
+/**
+  Computes exchanged common key.
+
+  Return FALSE to indicate this interface is not supported.
+
+  @param[in, out]  DhContext          Pointer to the DH context.
+  @param[in]       PeerPublicKey      Pointer to the peer's public key.
+  @param[in]       PeerPublicKeySize  Size of peer's public key in bytes.
+  @param[out]      Key                Pointer to the buffer to receive generated key.
+  @param[in, out]  KeySize            On input, the size of Key buffer in bytes.
+                                      On output, the size of data returned in Key buffer in bytes.
+
+  @retval FALSE  This interface is not supported.
+
+**/
+BOOLEAN
+EFIAPI
+DhComputeKey (
+  IN OUT  VOID         *DhContext,
+  IN      CONST UINT8  *PeerPublicKey,
+  IN      UINTN        PeerPublicKeySize,
+  OUT     UINT8        *Key,
+  IN OUT  UINTN        *KeySize
+  )
+{
+  ASSERT (FALSE);
+  return FALSE;
+}
diff --git a/CryptoPkg/Library/BaseCryptLibNull/Pk/CryptPkcs1OaepNull.c b/CryptoPkg/Library/BaseCryptLibNull/Pk/CryptPkcs1OaepNull.c
new file mode 100644
index 0000000000..6571fc4a2e
--- /dev/null
+++ b/CryptoPkg/Library/BaseCryptLibNull/Pk/CryptPkcs1OaepNull.c
@@ -0,0 +1,51 @@
+/** @file
+  This file contains UEFI wrapper functions for RSA PKCS1v2 OAEP encryption routines.
+
+  SPDX-License-Identifier: BSD-2-Clause-Patent
+
+  Copyright (C) 2016 Microsoft Corporation. All Rights Reserved.
+  Copyright (c) 2019, Intel Corporation. All rights reserved.<BR>
+
+**/
+
+#include "InternalCryptLib.h"
+
+/**
+  Encrypts a blob using PKCS1v2 (RSAES-OAEP) schema. On success, will return the
+  encrypted message in a newly allocated buffer.
+
+  Return FALSE to indicate this interface is not supported.
+
+  @param[in]  PublicKey           A pointer to the DER-encoded X509 certificate that
+                                  will be used to encrypt the data.
+  @param[in]  PublicKeySize       Size of the X509 cert buffer.
+  @param[in]  InData              Data to be encrypted.
+  @param[in]  InDataSize          Size of the data buffer.
+  @param[in]  PrngSeed            [Optional] If provided, a pointer to a random seed buffer
+                                  to be used when initializing the PRNG. NULL otherwise.
+  @param[in]  PrngSeedSize        [Optional] If provided, size of the random seed buffer.
+                                  0 otherwise.
+  @param[out] EncryptedData       Pointer to an allocated buffer containing the encrypted
+                                  message.
+  @param[out] EncryptedDataSize   Size of the encrypted message buffer.
+
+  @retval FALSE                   This interface is not supported.
+
+**/
+BOOLEAN
+EFIAPI
+Pkcs1v2Encrypt (
+  IN   CONST UINT8  *PublicKey,
+  IN   UINTN        PublicKeySize,
+  IN   UINT8        *InData,
+  IN   UINTN        InDataSize,
+  IN   CONST UINT8  *PrngSeed,  OPTIONAL
+  IN   UINTN        PrngSeedSize,  OPTIONAL
+  OUT  UINT8        **EncryptedData,
+  OUT  UINTN        *EncryptedDataSize
+  )
+{
+  ASSERT (FALSE);
+  return FALSE;
+}
+
diff --git a/CryptoPkg/Library/BaseCryptLibNull/Pk/CryptPkcs5Pbkdf2Null.c b/CryptoPkg/Library/BaseCryptLibNull/Pk/CryptPkcs5Pbkdf2Null.c
new file mode 100644
index 0000000000..7332db3ba1
--- /dev/null
+++ b/CryptoPkg/Library/BaseCryptLibNull/Pk/CryptPkcs5Pbkdf2Null.c
@@ -0,0 +1,48 @@
+/** @file
+  PBKDF2 Key Derivation Function Wrapper Implementation which does not provide real
+  capabilities.
+
+Copyright (c) 2016, Intel Corporation. All rights reserved.<BR>
+SPDX-License-Identifier: BSD-2-Clause-Patent
+
+**/
+
+#include "InternalCryptLib.h"
+
+/**
+  Derives a key from a password using a salt and iteration count, based on PKCS#5 v2.0
+  password based encryption key derivation function PBKDF2, as specified in RFC 2898.
+
+  Return FALSE to indicate this interface is not supported.
+
+  @param[in]  PasswordLength  Length of input password in bytes.
+  @param[in]  Password        Pointer to the array for the password.
+  @param[in]  SaltLength      Size of the Salt in bytes.
+  @param[in]  Salt            Pointer to the Salt.
+  @param[in]  IterationCount  Number of iterations to perform. Its value should be
+                              greater than or equal to 1.
+  @param[in]  DigestSize      Size of the message digest to be used (eg. SHA256_DIGEST_SIZE).
+                              NOTE: DigestSize will be used to determine the hash algorithm.
+                                    Only SHA1_DIGEST_SIZE or SHA256_DIGEST_SIZE is supported.
+  @param[in]  KeyLength       Size of the derived key buffer in bytes.
+  @param[out] OutKey          Pointer to the output derived key buffer.
+
+  @retval  FALSE  This interface is not supported.
+
+**/
+BOOLEAN
+EFIAPI
+Pkcs5HashPassword (
+  IN  UINTN        PasswordLength,
+  IN  CONST CHAR8  *Password,
+  IN  UINTN        SaltLength,
+  IN  CONST UINT8  *Salt,
+  IN  UINTN        IterationCount,
+  IN  UINTN        DigestSize,
+  IN  UINTN        KeyLength,
+  OUT UINT8        *OutKey
+  )
+{
+  ASSERT (FALSE);
+  return FALSE;
+}
diff --git a/CryptoPkg/Library/BaseCryptLibNull/Pk/CryptPkcs7SignNull.c b/CryptoPkg/Library/BaseCryptLibNull/Pk/CryptPkcs7SignNull.c
new file mode 100644
index 0000000000..d7ff8ba947
--- /dev/null
+++ b/CryptoPkg/Library/BaseCryptLibNull/Pk/CryptPkcs7SignNull.c
@@ -0,0 +1,54 @@
+/** @file
+  PKCS#7 SignedData Sign Wrapper Implementation which does not provide real
+  capabilities.
+
+Copyright (c) 2012, Intel Corporation. All rights reserved.<BR>
+SPDX-License-Identifier: BSD-2-Clause-Patent
+
+**/
+
+#include "InternalCryptLib.h"
+
+/**
+  Creates a PKCS#7 signedData as described in "PKCS #7: Cryptographic Message
+  Syntax Standard, version 1.5". This interface is only intended to be used for
+  application to perform PKCS#7 functionality validation.
+
+  Return FALSE to indicate this interface is not supported.
+
+  @param[in]  PrivateKey       Pointer to the PEM-formatted private key data for
+                               data signing.
+  @param[in]  PrivateKeySize   Size of the PEM private key data in bytes.
+  @param[in]  KeyPassword      NULL-terminated passphrase used for encrypted PEM
+                               key data.
+  @param[in]  InData           Pointer to the content to be signed.
+  @param[in]  InDataSize       Size of InData in bytes.
+  @param[in]  SignCert         Pointer to signer's DER-encoded certificate to sign with.
+  @param[in]  OtherCerts       Pointer to an optional additional set of certificates to
+                               include in the PKCS#7 signedData (e.g. any intermediate
+                               CAs in the chain).
+  @param[out] SignedData       Pointer to output PKCS#7 signedData. It's caller's
+                               responsibility to free the buffer with FreePool().
+  @param[out] SignedDataSize   Size of SignedData in bytes.
+
+  @retval FALSE  This interface is not supported.
+
+**/
+BOOLEAN
+EFIAPI
+Pkcs7Sign (
+  IN   CONST UINT8  *PrivateKey,
+  IN   UINTN        PrivateKeySize,
+  IN   CONST UINT8  *KeyPassword,
+  IN   UINT8        *InData,
+  IN   UINTN        InDataSize,
+  IN   UINT8        *SignCert,
+  IN   UINT8        *OtherCerts      OPTIONAL,
+  OUT  UINT8        **SignedData,
+  OUT  UINTN        *SignedDataSize
+  )
+{
+  ASSERT (FALSE);
+  return FALSE;
+}
+
diff --git a/CryptoPkg/Library/BaseCryptLibNull/Pk/CryptPkcs7VerifyEkuNull.c b/CryptoPkg/Library/BaseCryptLibNull/Pk/CryptPkcs7VerifyEkuNull.c
new file mode 100644
index 0000000000..cbeea935c9
--- /dev/null
+++ b/CryptoPkg/Library/BaseCryptLibNull/Pk/CryptPkcs7VerifyEkuNull.c
@@ -0,0 +1,156 @@
+/** @file
+  PKCS7 Verify Null implementation.
+
+  Copyright (C) Microsoft Corporation. All Rights Reserved.
+  Copyright (c) 2019, Intel Corporation. All rights reserved.<BR>
+
+  SPDX-License-Identifier: BSD-2-Clause-Patent
+
+**/
+
+#include "InternalCryptLib.h"
+
+/**
+  This function will return the leaf signer certificate in a chain.  This is
+  required because certificate chains are not guaranteed to have the
+  certificates in the order that they were issued.
+
+  A typical certificate chain looks like this:
+
+
+                 ----------------------------
+                |            Root            |
+                 ----------------------------
+                               ^
+                               |
+                 ----------------------------
+                |          Policy CA         | <-- Typical Trust Anchor.
+                 ----------------------------
+                               ^
+                               |
+                 ----------------------------
+                |         Issuing CA         |
+                 ----------------------------
+                               ^
+                               |
+                 -----------------------------
+                /  End-Entity (leaf) signer  / <-- Bottom certificate.
+                -----------------------------  EKU: "1.3.6.1.4.1.311.76.9.21.1"
+                                                    (Firmware Signing)
+
+
+  @param[in]   CertChain            Certificate chain.
+
+  @param[out]  SignerCert           Last certificate in the chain.  For PKCS7 signatures,
+                                    this will be the end-entity (leaf) signer cert.
+
+  @retval EFI_SUCCESS               The required EKUs were found in the signature.
+  @retval EFI_INVALID_PARAMETER     A parameter was invalid.
+  @retval EFI_NOT_FOUND             The number of signers found was not 1.
+
+**/
+EFI_STATUS
+GetSignerCertificate (
+  IN CONST VOID *CertChain,
+  OUT VOID       **SignerCert
+  )
+{
+  ASSERT(FALSE);
+  return EFI_NOT_READY;
+
+}
+
+
+/**
+  Determines if the specified EKU represented in ASN1 form is present
+  in a given certificate.
+
+  @param[in]  Cert                  The certificate to check.
+
+  @param[in]  Asn1ToFind            The EKU to look for.
+
+  @retval EFI_SUCCESS               We successfully identified the signing type.
+  @retval EFI_INVALID_PARAMETER     A parameter was invalid.
+  @retval EFI_NOT_FOUND             One or more EKU's were not found in the signature.
+
+**/
+EFI_STATUS
+IsEkuInCertificate (
+  IN CONST VOID  *Cert,
+  IN VOID *Asn1ToFind
+  )
+{
+  ASSERT(FALSE);
+  return EFI_NOT_READY;
+}
+
+
+/**
+  Determines if the specified EKUs are present in a signing certificate.
+
+  @param[in]  SignerCert            The certificate to check.
+  @param[in]  RequiredEKUs          The EKUs to look for.
+  @param[in]  RequiredEKUsSize      The number of EKUs
+  @param[in]  RequireAllPresent     If TRUE, then all the specified EKUs
+                                    must be present in the certificate.
+
+  @retval EFI_SUCCESS               We successfully identified the signing type.
+  @retval EFI_INVALID_PARAMETER     A parameter was invalid.
+  @retval EFI_NOT_FOUND             One or more EKU's were not found in the signature.
+**/
+EFI_STATUS
+CheckEKUs(
+  IN CONST VOID     *SignerCert,
+  IN CONST CHAR8    *RequiredEKUs[],
+  IN CONST UINT32   RequiredEKUsSize,
+  IN BOOLEAN        RequireAllPresent
+  )
+{
+  ASSERT(FALSE);
+  return EFI_NOT_READY;
+}
+
+/**
+  This function receives a PKCS#7 formatted signature blob,
+  looks for the EKU SEQUENCE blob, and if found then looks
+  for all the required EKUs. This function was created so that
+  the Surface team can cut down on the number of Certificate
+  Authorities (CA's) by checking EKU's on leaf signers for
+  a specific product. This prevents one product's certificate
+  from signing another product's firmware or unlock blobs.
+
+  Note that this function does not validate the certificate chain.
+  That needs to be done before using this function.
+
+  @param[in]  Pkcs7Signature       The PKCS#7 signed information content block. An array
+                                   containing the content block with both the signature,
+                                   the signer's certificate, and any necessary intermediate
+                                   certificates.
+  @param[in]  Pkcs7SignatureSize   Number of bytes in Pkcs7Signature.
+  @param[in]  RequiredEKUs         Array of null-terminated strings listing OIDs of
+                                   required EKUs that must be present in the signature.
+  @param[in]  RequiredEKUsSize     Number of elements in the RequiredEKUs string array.
+  @param[in]  RequireAllPresent    If this is TRUE, then all of the specified EKU's
+                                   must be present in the leaf signer.  If it is
+                                   FALSE, then we will succeed if we find any
+                                   of the specified EKU's.
+
+  @retval EFI_SUCCESS              The required EKUs were found in the signature.
+  @retval EFI_INVALID_PARAMETER    A parameter was invalid.
+  @retval EFI_NOT_FOUND            One or more EKU's were not found in the signature.
+
+**/
+EFI_STATUS
+EFIAPI
+VerifyEKUsInPkcs7Signature (
+  IN CONST UINT8    *Pkcs7Signature,
+  IN CONST UINT32   SignatureSize,
+  IN CONST CHAR8    *RequiredEKUs[],
+  IN CONST UINT32   RequiredEKUsSize,
+  IN BOOLEAN        RequireAllPresent
+  )
+{
+  ASSERT(FALSE);
+  return EFI_NOT_READY;
+}
+
diff --git a/CryptoPkg/Library/BaseCryptLibNull/Pk/CryptPkcs7VerifyNull.c b/CryptoPkg/Library/BaseCryptLibNull/Pk/CryptPkcs7VerifyNull.c
new file mode 100644
index 0000000000..0ddf16a61b
--- /dev/null
+++ b/CryptoPkg/Library/BaseCryptLibNull/Pk/CryptPkcs7VerifyNull.c
@@ -0,0 +1,163 @@
+/** @file
+  PKCS#7 SignedData Verification Wrapper Implementation which does not provide
+  real capabilities.
+
+Copyright (c) 2012 - 2018, Intel Corporation. All rights reserved.<BR>
+SPDX-License-Identifier: BSD-2-Clause-Patent
+
+**/
+
+#include "InternalCryptLib.h"
+
+/**
+  Get the signer's certificates from PKCS#7 signed data as described in "PKCS #7:
+  Cryptographic Message Syntax Standard". The input signed data could be wrapped
+  in a ContentInfo structure.
+
+  Return FALSE to indicate this interface is not supported.
+
+  @param[in]  P7Data       Pointer to the PKCS#7 message to verify.
+  @param[in]  P7Length     Length of the PKCS#7 message in bytes.
+  @param[out] CertStack    Pointer to Signer's certificates retrieved from P7Data.
+                           It's caller's responsibility to free the buffer with
+                           Pkcs7FreeSigners().
+                           This data structure is EFI_CERT_STACK type.
+  @param[out] StackLength  Length of signer's certificates in bytes.
+  @param[out] TrustedCert  Pointer to a trusted certificate from Signer's certificates.
+                           It's caller's responsibility to free the buffer with
+                           Pkcs7FreeSigners().
+  @param[out] CertLength   Length of the trusted certificate in bytes.
+
+  @retval FALSE  This interface is not supported.
+
+**/
+BOOLEAN
+EFIAPI
+Pkcs7GetSigners (
+  IN  CONST UINT8  *P7Data,
+  IN  UINTN        P7Length,
+  OUT UINT8        **CertStack,
+  OUT UINTN        *StackLength,
+  OUT UINT8        **TrustedCert,
+  OUT UINTN        *CertLength
+  )
+{
+  ASSERT (FALSE);
+  return FALSE;
+}
+
+/**
+  Wrap function to use free() to free allocated memory for certificates.
+
+  If the interface is not supported, then ASSERT().
+
+  @param[in]  Certs        Pointer to the certificates to be freed.
+
+**/
+VOID
+EFIAPI
+Pkcs7FreeSigners (
+  IN  UINT8        *Certs
+  )
+{
+  ASSERT (FALSE);
+}
+
+/**
+  Retrieves all embedded certificates from PKCS#7 signed data as described in "PKCS #7:
+  Cryptographic Message Syntax Standard", and outputs two certificate lists chained and
+  unchained to the signer's certificates.
+  The input signed data could be wrapped in a ContentInfo structure.
+
+  @param[in]  P7Data            Pointer to the PKCS#7 message.
+  @param[in]  P7Length          Length of the PKCS#7 message in bytes.
+  @param[out] SignerChainCerts  Pointer to the certificates list chained to signer's
+                                certificate. It's caller's responsibility to free the buffer
+                                with Pkcs7FreeSigners().
+                                This data structure is EFI_CERT_STACK type.
+  @param[out] ChainLength       Length of the chained certificates list buffer in bytes.
+  @param[out] UnchainCerts      Pointer to the unchained certificates lists. It's caller's
+                                responsibility to free the buffer with Pkcs7FreeSigners().
+                                This data structure is EFI_CERT_STACK type.
+  @param[out] UnchainLength     Length of the unchained certificates list buffer in bytes.
+
+  @retval  TRUE         The operation is finished successfully.
+  @retval  FALSE        Error occurs during the operation.
+
+**/
+BOOLEAN
+EFIAPI
+Pkcs7GetCertificatesList (
+  IN  CONST UINT8  *P7Data,
+  IN  UINTN        P7Length,
+  OUT UINT8        **SignerChainCerts,
+  OUT UINTN        *ChainLength,
+  OUT UINT8        **UnchainCerts,
+  OUT UINTN        *UnchainLength
+  )
+{
+  ASSERT (FALSE);
+  return FALSE;
+}
+
+/**
+  Verifies the validity of a PKCS#7 signed data as described in "PKCS #7:
+  Cryptographic Message Syntax Standard". The input signed data could be wrapped
+  in a ContentInfo structure.
+
+  Return FALSE to indicate this interface is not supported.
+
+  @param[in]  P7Data       Pointer to the PKCS#7 message to verify.
+  @param[in]  P7Length     Length of the PKCS#7 message in bytes.
+  @param[in]  TrustedCert  Pointer to a trusted/root certificate encoded in DER, which
+                           is used for certificate chain verification.
+  @param[in]  CertLength   Length of the trusted certificate in bytes.
+  @param[in]  InData       Pointer to the content to be verified.
+  @param[in]  DataLength   Length of InData in bytes.
+
+  @retval FALSE  This interface is not supported.
+
+**/
+BOOLEAN
+EFIAPI
+Pkcs7Verify (
+  IN  CONST UINT8  *P7Data,
+  IN  UINTN        P7Length,
+  IN  CONST UINT8  *TrustedCert,
+  IN  UINTN        CertLength,
+  IN  CONST UINT8  *InData,
+  IN  UINTN        DataLength
+  )
+{
+  ASSERT (FALSE);
+  return FALSE;
+}
+
+/**
+  Extracts the attached content from a PKCS#7 signed data if existed. The input signed
+  data could be wrapped in a ContentInfo structure.
+
+  Return FALSE to indicate this interface is not supported.
+
+  @param[in]   P7Data       Pointer to the PKCS#7 signed data to process.
+  @param[in]   P7Length     Length of the PKCS#7 signed data in bytes.
+  @param[out]  Content      Pointer to the extracted content from the PKCS#7 signedData.
+                            It's caller's responsibility to free the buffer with FreePool().
+  @param[out]  ContentSize  The size of the extracted content in bytes.
+
+  @retval     TRUE          The P7Data was correctly formatted for processing.
+  @retval     FALSE         The P7Data was not correctly formatted for processing.
+
+**/
+BOOLEAN
+EFIAPI
+Pkcs7GetAttachedContent (
+  IN  CONST UINT8  *P7Data,
+  IN  UINTN        P7Length,
+  OUT VOID         **Content,
+  OUT UINTN        *ContentSize
+  )
+{
+  ASSERT (FALSE);
+  return FALSE;
+}
diff --git a/CryptoPkg/Library/BaseCryptLibNull/Pk/CryptRsaBasicNull.c b/CryptoPkg/Library/BaseCryptLibNull/Pk/CryptRsaBasicNull.c
new file mode 100644
index 0000000000..fd352e32dd
--- /dev/null
+++ b/CryptoPkg/Library/BaseCryptLibNull/Pk/CryptRsaBasicNull.c
@@ -0,0 +1,121 @@
+/** @file
+  RSA Asymmetric Cipher Wrapper Null Implementation.
+
+  This file implements following APIs which provide basic capabilities for RSA:
+  1) RsaNew
+  2) RsaFree
+  3) RsaSetKey
+  4) RsaPkcs1Verify
+
+Copyright (c) 2009 - 2018, Intel Corporation. All rights reserved.<BR>
+SPDX-License-Identifier: BSD-2-Clause-Patent
+
+**/
+
+#include "InternalCryptLib.h"
+
+/**
+  Allocates and initializes one RSA context for subsequent use.
+
+  @return  Pointer to the RSA context that has been initialized.
+           If the allocations fails, RsaNew() returns NULL.
+
+**/
+VOID *
+EFIAPI
+RsaNew (
+  VOID
+  )
+{
+  //
+  // Allocates & Initializes RSA Context
+  //
+  ASSERT (FALSE);
+  return NULL;
+}
+
+/**
+  Release the specified RSA context.
+
+  @param[in]  RsaContext  Pointer to the RSA context to be released.
+
+**/
+VOID
+EFIAPI
+RsaFree (
+  IN  VOID  *RsaContext
+  )
+{
+  //
+  // Free RSA Context
+  //
+  ASSERT (FALSE);
+}
+
+/**
+  Sets the tag-designated key component into the established RSA context.
+
+  This function sets the tag-designated RSA key component into the established
+  RSA context from the user-specified non-negative integer (octet string format
+  represented in RSA PKCS#1).
+  If BigNumber is NULL, then the specified key component in RSA context is cleared.
+
+  If RsaContext is NULL, then return FALSE.
+
+  @param[in, out]  RsaContext  Pointer to RSA context being set.
+  @param[in]       KeyTag      Tag of RSA key component being set.
+  @param[in]       BigNumber   Pointer to octet integer buffer.
+                               If NULL, then the specified key component in RSA
+                               context is cleared.
+  @param[in]       BnSize      Size of big number buffer in bytes.
+                               If BigNumber is NULL, then it is ignored.
+
+  @retval  TRUE   RSA key component was set successfully.
+  @retval  FALSE  Invalid RSA key component tag.
+
+**/
+BOOLEAN
+EFIAPI
+RsaSetKey (
+  IN OUT  VOID         *RsaContext,
+  IN      RSA_KEY_TAG  KeyTag,
+  IN      CONST UINT8  *BigNumber,
+  IN      UINTN        BnSize
+  )
+{
+  ASSERT (FALSE);
+  return FALSE;
+}
+
+/**
+  Verifies the RSA-SSA signature with EMSA-PKCS1-v1_5 encoding scheme defined in
+  RSA PKCS#1.
+
+  If RsaContext is NULL, then return FALSE.
+  If MessageHash is NULL, then return FALSE.
+  If Signature is NULL, then return FALSE.
+  If HashSize is not equal to the size of MD5, SHA-1 or SHA-256 digest, then return FALSE.
+
+  @param[in]  RsaContext   Pointer to RSA context for signature verification.
+  @param[in]  MessageHash  Pointer to octet message hash to be checked.
+  @param[in]  HashSize     Size of the message hash in bytes.
+  @param[in]  Signature    Pointer to RSA PKCS1-v1_5 signature to be verified.
+  @param[in]  SigSize      Size of signature in bytes.
+
+  @retval  TRUE   Valid signature encoded in PKCS1-v1_5.
+  @retval  FALSE  Invalid signature or invalid RSA context.
+
+**/
+BOOLEAN
+EFIAPI
+RsaPkcs1Verify (
+  IN  VOID         *RsaContext,
+  IN  CONST UINT8  *MessageHash,
+  IN  UINTN        HashSize,
+  IN  CONST UINT8  *Signature,
+  IN  UINTN        SigSize
+  )
+{
+  ASSERT (FALSE);
+  return FALSE;
+}
diff --git a/CryptoPkg/Library/BaseCryptLibNull/Pk/CryptRsaExtNull.c b/CryptoPkg/Library/BaseCryptLibNull/Pk/CryptRsaExtNull.c
new file mode 100644
index 0000000000..2e74494c52
--- /dev/null
+++ b/CryptoPkg/Library/BaseCryptLibNull/Pk/CryptRsaExtNull.c
@@ -0,0 +1,119 @@
+/** @file
+  RSA Asymmetric Cipher Wrapper Null Implementation.
+
+  This file does not provide real capabilities for following APIs in RSA handling:
+  1) RsaGetKey
+  2) RsaGenerateKey
+  3) RsaCheckKey
+  4) RsaPkcs1Sign
+
+Copyright (c) 2009 - 2018, Intel Corporation. All rights reserved.<BR>
+SPDX-License-Identifier: BSD-2-Clause-Patent
+
+**/
+
+#include "InternalCryptLib.h"
+
+/**
+  Gets the tag-designated RSA key component from the established RSA context.
+
+  Return FALSE to indicate this interface is not supported.
+
+  @param[in, out]  RsaContext  Pointer to RSA context being set.
+  @param[in]       KeyTag      Tag of RSA key component being set.
+  @param[out]      BigNumber   Pointer to octet integer buffer.
+  @param[in, out]  BnSize      On input, the size of big number buffer in bytes.
+                               On output, the size of data returned in big number buffer in bytes.
+
+  @retval FALSE  This interface is not supported.
+
+**/
+BOOLEAN
+EFIAPI
+RsaGetKey (
+  IN OUT  VOID         *RsaContext,
+  IN      RSA_KEY_TAG  KeyTag,
+  OUT     UINT8        *BigNumber,
+  IN OUT  UINTN        *BnSize
+  )
+{
+  ASSERT (FALSE);
+  return FALSE;
+}
+
+/**
+  Generates RSA key components.
+
+  Return FALSE to indicate this interface is not supported.
+
+  @param[in, out]  RsaContext           Pointer to RSA context being set.
+  @param[in]       ModulusLength        Length of RSA modulus N in bits.
+  @param[in]       PublicExponent       Pointer to RSA public exponent.
+  @param[in]       PublicExponentSize   Size of RSA public exponent buffer in bytes.
+
+  @retval FALSE  This interface is not supported.
+
+**/
+BOOLEAN
+EFIAPI
+RsaGenerateKey (
+  IN OUT  VOID         *RsaContext,
+  IN      UINTN        ModulusLength,
+  IN      CONST UINT8  *PublicExponent,
+  IN      UINTN        PublicExponentSize
+  )
+{
+  ASSERT (FALSE);
+  return FALSE;
+}
+
+/**
+  Validates key components of RSA context.
+
+  Return FALSE to indicate this interface is not supported.
+
+  @param[in]  RsaContext  Pointer to RSA context to check.
+
+  @retval FALSE  This interface is not supported.
+
+**/
+BOOLEAN
+EFIAPI
+RsaCheckKey (
+  IN  VOID  *RsaContext
+  )
+{
+  ASSERT (FALSE);
+  return FALSE;
+}
+
+/**
+  Carries out the RSA-SSA signature generation with EMSA-PKCS1-v1_5 encoding scheme.
+
+  Return FALSE to indicate this interface is not supported.
+
+  @param[in]       RsaContext   Pointer to RSA context for signature generation.
+  @param[in]       MessageHash  Pointer to octet message hash to be signed.
+  @param[in]       HashSize     Size of the message hash in bytes.
+  @param[out]      Signature    Pointer to buffer to receive RSA PKCS1-v1_5 signature.
+  @param[in, out]  SigSize      On input, the size of Signature buffer in bytes.
+                                On output, the size of data returned in Signature buffer in bytes.
+
+  @retval FALSE  This interface is not supported.
+
+**/
+BOOLEAN
+EFIAPI
+RsaPkcs1Sign (
+  IN      VOID         *RsaContext,
+  IN      CONST UINT8  *MessageHash,
+  IN      UINTN        HashSize,
+  OUT     UINT8        *Signature,
+  IN OUT  UINTN        *SigSize
+  )
+{
+  ASSERT (FALSE);
+  return FALSE;
+}
+
+
diff --git a/CryptoPkg/Library/BaseCryptLibNull/Pk/CryptTsNull.c b/CryptoPkg/Library/BaseCryptLibNull/Pk/CryptTsNull.c
new file mode 100644
index 0000000000..907988814a
--- /dev/null
+++ b/CryptoPkg/Library/BaseCryptLibNull/Pk/CryptTsNull.c
@@ -0,0 +1,42 @@
+/** @file
+  RFC3161 Timestamp Countersignature Verification Wrapper Implementation which does
+  not provide real capabilities.
+
+Copyright (c) 2014, Intel Corporation. All rights reserved.<BR>
+SPDX-License-Identifier: BSD-2-Clause-Patent
+
+**/
+
+#include "InternalCryptLib.h"
+
+/**
+  Verifies the validity of a RFC3161 Timestamp CounterSignature embedded in PE/COFF Authenticode
+  signature.
+
+  Return FALSE to indicate this interface is not supported.
+
+  @param[in]  AuthData     Pointer to the Authenticode Signature retrieved from signed
+                           PE/COFF image to be verified.
+  @param[in]  DataSize     Size of the Authenticode Signature in bytes.
+  @param[in]  TsaCert      Pointer to a trusted/root TSA certificate encoded in DER, which
+                           is used for TSA certificate chain verification.
+  @param[in]  CertSize     Size of the trusted certificate in bytes.
+  @param[out] SigningTime  Return the time of timestamp generation time if the timestamp
+                           signature is valid.
+
+  @retval  FALSE  This interface is not supported.
+
+**/
+BOOLEAN
+EFIAPI
+ImageTimestampVerify (
+  IN  CONST UINT8  *AuthData,
+  IN  UINTN        DataSize,
+  IN  CONST UINT8  *TsaCert,
+  IN  UINTN        CertSize,
+  OUT EFI_TIME     *SigningTime
+  )
+{
+  ASSERT (FALSE);
+  return FALSE;
+}
diff --git a/CryptoPkg/Library/BaseCryptLibNull/Pk/CryptX509Null.c b/CryptoPkg/Library/BaseCryptLibNull/Pk/CryptX509Null.c
new file mode 100644
index 0000000000..5e59cb1634
--- /dev/null
+++ b/CryptoPkg/Library/BaseCryptLibNull/Pk/CryptX509Null.c
@@ -0,0 +1,264 @@
+/** @file
+  X.509 Certificate Handler Wrapper Implementation which does not provide
+  real capabilities.
+
+Copyright (c) 2012 - 2018, Intel Corporation. All rights reserved.<BR>
+SPDX-License-Identifier: BSD-2-Clause-Patent
+
+**/
+
+#include "InternalCryptLib.h"
+
+/**
+  Construct a X509 object from DER-encoded certificate data.
+
+  Return FALSE to indicate this interface is not supported.
+
+  @param[in]  Cert            Pointer to the DER-encoded certificate data.
+  @param[in]  CertSize        The size of certificate data in bytes.
+  @param[out] SingleX509Cert  The generated X509 object.
+
+  @retval FALSE  This interface is not supported.
+
+**/
+BOOLEAN
+EFIAPI
+X509ConstructCertificate (
+  IN   CONST UINT8  *Cert,
+  IN   UINTN        CertSize,
+  OUT  UINT8        **SingleX509Cert
+  )
+{
+  ASSERT (FALSE);
+  return FALSE;
+}
+
+/**
+  Construct a X509 stack object from a list of DER-encoded certificate data.
+
+  Return FALSE to indicate this interface is not supported.
+
+  @param[in, out]  X509Stack  On input, pointer to an existing or NULL X509 stack object.
+                              On output, pointer to the X509 stack object with new
+                              inserted X509 certificate.
+  @param           ...        A list of DER-encoded single certificate data followed
+                              by certificate size. A NULL terminates the list. The
+                              pairs are the arguments to X509ConstructCertificate().
+
+  @retval FALSE  This interface is not supported.
+
+**/
+BOOLEAN
+EFIAPI
+X509ConstructCertificateStack (
+  IN OUT  UINT8  **X509Stack,
+  ...
+  )
+{
+  ASSERT (FALSE);
+  return FALSE;
+}
+
+/**
+  Release the specified X509 object.
+
+  If the interface is not supported, then ASSERT().
+
+  @param[in]  X509Cert  Pointer to the X509 object to be released.
+
+**/
+VOID
+EFIAPI
+X509Free (
+  IN  VOID  *X509Cert
+  )
+{
+  ASSERT (FALSE);
+}
+
+/**
+  Release the specified X509 stack object.
+
+  If the interface is not supported, then ASSERT().
+
+  @param[in]  X509Stack  Pointer to the X509 stack object to be released.
+
+**/
+VOID
+EFIAPI
+X509StackFree (
+  IN  VOID  *X509Stack
+  )
+{
+  ASSERT (FALSE);
+}
+
+/**
+  Retrieve the subject bytes from one X.509 certificate.
+
+  Return FALSE to indicate this interface is not supported.
+
+  @param[in]      Cert         Pointer to the DER-encoded X509 certificate.
+  @param[in]      CertSize     Size of the X509 certificate in bytes.
+  @param[out]     CertSubject  Pointer to the retrieved certificate subject bytes.
+  @param[in, out] SubjectSize  The size in bytes of the CertSubject buffer on input,
+                               and the size of buffer returned CertSubject on output.
+
+
+  @retval FALSE  This interface is not supported.
+
+**/
+BOOLEAN
+EFIAPI
+X509GetSubjectName (
+  IN      CONST UINT8  *Cert,
+  IN      UINTN        CertSize,
+  OUT     UINT8        *CertSubject,
+  IN OUT  UINTN        *SubjectSize
+  )
+{
+  ASSERT (FALSE);
+  return FALSE;
+}
+
+/**
+  Retrieve the common name (CN) string from one X.509 certificate.
+
+  Return RETURN_UNSUPPORTED to indicate this interface is not supported.
+
+  @param[in]      Cert             Pointer to the DER-encoded X509 certificate.
+  @param[in]      CertSize         Size of the X509 certificate in bytes.
+  @param[out]     CommonName       Buffer to contain the retrieved certificate common
+                                   name string (UTF8). At most CommonNameSize bytes will be
+                                   written and the string will be null terminated. May be
+                                   NULL in order to determine the size buffer needed.
+  @param[in,out]  CommonNameSize   The size in bytes of the CommonName buffer on input,
+                                   and the size of buffer returned CommonName on output.
+                                   If CommonName is NULL then the amount of space needed
+                                   in buffer (including the final null) is returned.
+
+  @retval RETURN_UNSUPPORTED       The operation is not supported.
+
+**/
+RETURN_STATUS
+EFIAPI
+X509GetCommonName (
+  IN      CONST UINT8  *Cert,
+  IN      UINTN        CertSize,
+  OUT     CHAR8        *CommonName,  OPTIONAL
+  IN OUT  UINTN        *CommonNameSize
+  )
+{
+  ASSERT (FALSE);
+  return RETURN_UNSUPPORTED;
+}
+
+/**
+  Retrieve the organization name (ON) string from one X.509 certificate.
+
+  Return RETURN_UNSUPPORTED to indicate this interface is not supported.
+
+  @param[in]      Cert             Pointer to the DER-encoded X509 certificate.
+  @param[in]      CertSize         Size of the X509 certificate in bytes.
+  @param[out]     NameBuffer       Buffer to contain the retrieved certificate organization
+                                   name string. At most NameBufferSize bytes will be
+                                   written and the string will be null terminated. May be
+                                   NULL in order to determine the size buffer needed.
+  @param[in,out]  NameBufferSize   The size in bytes of the Name buffer on input,
+                                   and the size of buffer returned Name on output.
+                                   If NameBuffer is NULL then the amount of space needed
+                                   in buffer (including the final null) is returned.
+
+  @retval RETURN_UNSUPPORTED       The operation is not supported.
+
+**/
+RETURN_STATUS
+EFIAPI
+X509GetOrganizationName (
+  IN      CONST UINT8   *Cert,
+  IN      UINTN         CertSize,
+  OUT     CHAR8         *NameBuffer,  OPTIONAL
+  IN OUT  UINTN         *NameBufferSize
+  )
+{
+  ASSERT (FALSE);
+  return RETURN_UNSUPPORTED;
+}
+
+/**
+  Retrieve the RSA Public Key from one DER-encoded X509 certificate.
+
+  Return FALSE to indicate this interface is not supported.
+
+  @param[in]  Cert         Pointer to the DER-encoded X509 certificate.
+  @param[in]  CertSize     Size of the X509 certificate in bytes.
+  @param[out] RsaContext   Pointer to new-generated RSA context which contain the retrieved
+                           RSA public key component. Use RsaFree() function to free the
+                           resource.
+
+  @retval FALSE  This interface is not supported.
+
+**/
+BOOLEAN
+EFIAPI
+RsaGetPublicKeyFromX509 (
+  IN   CONST UINT8  *Cert,
+  IN   UINTN        CertSize,
+  OUT  VOID         **RsaContext
+  )
+{
+  ASSERT (FALSE);
+  return FALSE;
+}
+
+/**
+  Verify one X509 certificate was issued by the trusted CA.
+
+  Return FALSE to indicate this interface is not supported.
+
+  @param[in]      Cert         Pointer to the DER-encoded X509 certificate to be verified.
+  @param[in]      CertSize     Size of the X509 certificate in bytes.
+  @param[in]      CACert       Pointer to the DER-encoded trusted CA certificate.
+  @param[in]      CACertSize   Size of the CA Certificate in bytes.
+
+  @retval FALSE  This interface is not supported.
+
+**/
+BOOLEAN
+EFIAPI
+X509VerifyCert (
+  IN  CONST UINT8  *Cert,
+  IN  UINTN        CertSize,
+  IN  CONST UINT8  *CACert,
+  IN  UINTN        CACertSize
+  )
+{
+  ASSERT (FALSE);
+  return FALSE;
+}
+
+/**
+  Retrieve the TBSCertificate from one given X.509 certificate.
+
+  Return FALSE to indicate this interface is not supported.
+
+  @param[in]      Cert         Pointer to the given DER-encoded X509 certificate.
+  @param[in]      CertSize     Size of the X509 certificate in bytes.
+  @param[out]     TBSCert      DER-Encoded To-Be-Signed certificate.
+  @param[out]     TBSCertSize  Size of the TBS certificate in bytes.
+
+  @retval  FALSE  This interface is not supported.
+
+**/
+BOOLEAN
+EFIAPI
+X509GetTBSCert (
+  IN  CONST UINT8  *Cert,
+  IN  UINTN        CertSize,
+  OUT UINT8        **TBSCert,
+  OUT UINTN        *TBSCertSize
+  )
+{
+  ASSERT (FALSE);
+  return FALSE;
+}
diff --git a/CryptoPkg/Library/BaseCryptLibNull/Rand/CryptRandNull.c b/CryptoPkg/Library/BaseCryptLibNull/Rand/CryptRandNull.c
new file mode 100644
index 0000000000..d2914f8758
--- /dev/null
+++ b/CryptoPkg/Library/BaseCryptLibNull/Rand/CryptRandNull.c
@@ -0,0 +1,57 @@
+/** @file
+  Pseudorandom Number Generator Wrapper Implementation which does not provide
+  real capabilities.
+
+Copyright (c) 2012, Intel Corporation. All rights reserved.<BR>
+SPDX-License-Identifier: BSD-2-Clause-Patent
+
+**/
+
+#include "InternalCryptLib.h"
+
+
+/**
+  Sets up the seed value for the pseudorandom number generator.
+
+  Return FALSE to indicate this interface is not supported.
+
+  @param[in]  Seed      Pointer to seed value.
+                        If NULL, default seed is used.
+  @param[in]  SeedSize  Size of seed value.
+                        If Seed is NULL, this parameter is ignored.
+
+  @retval FALSE  This interface is not supported.
+
+**/
+BOOLEAN
+EFIAPI
+RandomSeed (
+  IN  CONST  UINT8  *Seed  OPTIONAL,
+  IN  UINTN         SeedSize
+  )
+{
+  ASSERT (FALSE);
+  return FALSE;
+}
+
+/**
+  Generates a pseudorandom byte stream of the specified size.
+
+  Return FALSE to indicate this interface is not supported.
+
+  @param[out]  Output  Pointer to buffer to receive random value.
+  @param[in]   Size    Size of random bytes to generate.
+
+  @retval FALSE  This interface is not supported.
+
+**/
+BOOLEAN
+EFIAPI
+RandomBytes (
+  OUT  UINT8  *Output,
+  IN   UINTN  Size
+  )
+{
+  ASSERT (FALSE);
+  return FALSE;
+}
-- 
2.21.0.windows.1


-=-=-=-=-=-=-=-=-=-=-=-
Groups.io Links: You receive all messages sent to this group.

View/Reply Online (#49368): https://edk2.groups.io/g/devel/message/49368
Mute This Topic: https://groups.io/mt/36469339/1787277
Group Owner: devel+owner@edk2.groups.io
Unsubscribe: https://edk2.groups.io/g/devel/unsub  [importer@patchew.org]
-=-=-=-=-=-=-=-=-=-=-=-

Reviewed-by: Jian J Wang <jian.j.wang@intel.com>

Regards,
Jian

> -----Original Message-----
> From: Kinney, Michael D <michael.d.kinney@intel.com>
> Sent: Wednesday, October 23, 2019 6:30 AM
> To: devel@edk2.groups.io
> Cc: Sean Brogan <sean.brogan@microsoft.com>; Wang, Jian J
> <jian.j.wang@intel.com>; Lu, XiaoyuX <xiaoyux.lu@intel.com>
> Subject: [Patch] CryptoPkg: Add Null instance of the BaseCryptLib class
> 
> From: Sean Brogan <sean.brogan@microsoft.com>
> 
> https://bugzilla.tianocore.org/show_bug.cgi?id=2257
> 
> Add a Null instance of the BaseCryptLib class.  This lib instance
> can be used as a template for new implementations of the BaseCryptLib
> class and can also be used to reduce CI build times for build
> checks that depend on the BaseCryptLib class.
> 
> Cc: Jian J Wang <jian.j.wang@intel.com>
> Cc: Xiaoyu Lu <xiaoyux.lu@intel.com>
> Signed-off-by: Michael D Kinney <michael.d.kinney@intel.com>
> ---
>  CryptoPkg/CryptoPkg.dsc                       |   1 +
>  .../BaseCryptLibNull/BaseCryptLibNull.inf     |  62 ++++
>  .../BaseCryptLibNull/BaseCryptLibNull.uni     |  18 ++
>  .../BaseCryptLibNull/Cipher/CryptAesNull.c    | 159 ++++++++++
>  .../BaseCryptLibNull/Cipher/CryptArc4Null.c   | 124 ++++++++
>  .../BaseCryptLibNull/Cipher/CryptTdesNull.c   | 160 ++++++++++
>  .../BaseCryptLibNull/Hash/CryptMd4Null.c      | 143 +++++++++
>  .../BaseCryptLibNull/Hash/CryptMd5Null.c      | 165 +++++++++++
>  .../BaseCryptLibNull/Hash/CryptSha1Null.c     | 167 +++++++++++
>  .../BaseCryptLibNull/Hash/CryptSha256Null.c   | 162 +++++++++++
>  .../BaseCryptLibNull/Hash/CryptSha512Null.c   | 275 ++++++++++++++++++
>  .../BaseCryptLibNull/Hash/CryptSm3Null.c      | 164 +++++++++++
>  .../BaseCryptLibNull/Hmac/CryptHmacMd5Null.c  | 159 ++++++++++
>  .../BaseCryptLibNull/Hmac/CryptHmacSha1Null.c | 159 ++++++++++
>  .../Hmac/CryptHmacSha256Null.c                | 159 ++++++++++
>  .../BaseCryptLibNull/InternalCryptLib.h       |  16 +
>  .../BaseCryptLibNull/Pem/CryptPemNull.c       |  38 +++
>  .../Pk/CryptAuthenticodeNull.c                |  45 +++
>  .../Library/BaseCryptLibNull/Pk/CryptDhNull.c | 150 ++++++++++
>  .../BaseCryptLibNull/Pk/CryptPkcs1OaepNull.c  |  51 ++++
>  .../Pk/CryptPkcs5Pbkdf2Null.c                 |  48 +++
>  .../BaseCryptLibNull/Pk/CryptPkcs7SignNull.c  |  54 ++++
>  .../Pk/CryptPkcs7VerifyEkuNull.c              | 156 ++++++++++
>  .../Pk/CryptPkcs7VerifyNull.c                 | 163 +++++++++++
>  .../BaseCryptLibNull/Pk/CryptRsaBasicNull.c   | 121 ++++++++
>  .../BaseCryptLibNull/Pk/CryptRsaExtNull.c     | 119 ++++++++
>  .../Library/BaseCryptLibNull/Pk/CryptTsNull.c |  42 +++
>  .../BaseCryptLibNull/Pk/CryptX509Null.c       | 264 +++++++++++++++++
>  .../BaseCryptLibNull/Rand/CryptRandNull.c     |  57 ++++
>  29 files changed, 3401 insertions(+)
>  create mode 100644 CryptoPkg/Library/BaseCryptLibNull/BaseCryptLibNull.inf
>  create mode 100644 CryptoPkg/Library/BaseCryptLibNull/BaseCryptLibNull.uni
>  create mode 100644
> CryptoPkg/Library/BaseCryptLibNull/Cipher/CryptAesNull.c
>  create mode 100644
> CryptoPkg/Library/BaseCryptLibNull/Cipher/CryptArc4Null.c
>  create mode 100644
> CryptoPkg/Library/BaseCryptLibNull/Cipher/CryptTdesNull.c
>  create mode 100644 CryptoPkg/Library/BaseCryptLibNull/Hash/CryptMd4Null.c
>  create mode 100644 CryptoPkg/Library/BaseCryptLibNull/Hash/CryptMd5Null.c
>  create mode 100644 CryptoPkg/Library/BaseCryptLibNull/Hash/CryptSha1Null.c
>  create mode 100644
> CryptoPkg/Library/BaseCryptLibNull/Hash/CryptSha256Null.c
>  create mode 100644
> CryptoPkg/Library/BaseCryptLibNull/Hash/CryptSha512Null.c
>  create mode 100644 CryptoPkg/Library/BaseCryptLibNull/Hash/CryptSm3Null.c
>  create mode 100644
> CryptoPkg/Library/BaseCryptLibNull/Hmac/CryptHmacMd5Null.c
>  create mode 100644
> CryptoPkg/Library/BaseCryptLibNull/Hmac/CryptHmacSha1Null.c
>  create mode 100644
> CryptoPkg/Library/BaseCryptLibNull/Hmac/CryptHmacSha256Null.c
>  create mode 100644 CryptoPkg/Library/BaseCryptLibNull/InternalCryptLib.h
>  create mode 100644 CryptoPkg/Library/BaseCryptLibNull/Pem/CryptPemNull.c
>  create mode 100644
> CryptoPkg/Library/BaseCryptLibNull/Pk/CryptAuthenticodeNull.c
>  create mode 100644 CryptoPkg/Library/BaseCryptLibNull/Pk/CryptDhNull.c
>  create mode 100644
> CryptoPkg/Library/BaseCryptLibNull/Pk/CryptPkcs1OaepNull.c
>  create mode 100644
> CryptoPkg/Library/BaseCryptLibNull/Pk/CryptPkcs5Pbkdf2Null.c
>  create mode 100644
> CryptoPkg/Library/BaseCryptLibNull/Pk/CryptPkcs7SignNull.c
>  create mode 100644
> CryptoPkg/Library/BaseCryptLibNull/Pk/CryptPkcs7VerifyEkuNull.c
>  create mode 100644
> CryptoPkg/Library/BaseCryptLibNull/Pk/CryptPkcs7VerifyNull.c
>  create mode 100644
> CryptoPkg/Library/BaseCryptLibNull/Pk/CryptRsaBasicNull.c
>  create mode 100644 CryptoPkg/Library/BaseCryptLibNull/Pk/CryptRsaExtNull.c
>  create mode 100644 CryptoPkg/Library/BaseCryptLibNull/Pk/CryptTsNull.c
>  create mode 100644 CryptoPkg/Library/BaseCryptLibNull/Pk/CryptX509Null.c
>  create mode 100644
> CryptoPkg/Library/BaseCryptLibNull/Rand/CryptRandNull.c
> 
> diff --git a/CryptoPkg/CryptoPkg.dsc b/CryptoPkg/CryptoPkg.dsc
> index c90e76c721..3e5045e835 100644
> --- a/CryptoPkg/CryptoPkg.dsc
> +++ b/CryptoPkg/CryptoPkg.dsc
> @@ -114,6 +114,7 @@ [Components]
>    CryptoPkg/Library/BaseCryptLib/BaseCryptLib.inf
>    CryptoPkg/Library/BaseCryptLib/PeiCryptLib.inf
>    CryptoPkg/Library/BaseCryptLib/RuntimeCryptLib.inf
> +  CryptoPkg/Library/BaseCryptLibNull/BaseCryptLibNull.inf
>    CryptoPkg/Library/TlsLib/TlsLib.inf
>    CryptoPkg/Library/OpensslLib/OpensslLib.inf
>    CryptoPkg/Library/OpensslLib/OpensslLibCrypto.inf
> diff --git a/CryptoPkg/Library/BaseCryptLibNull/BaseCryptLibNull.inf
> b/CryptoPkg/Library/BaseCryptLibNull/BaseCryptLibNull.inf
> new file mode 100644
> index 0000000000..1e4807968a
> --- /dev/null
> +++ b/CryptoPkg/Library/BaseCryptLibNull/BaseCryptLibNull.inf
> @@ -0,0 +1,62 @@
> +## @file
> +#  Cryptographic Library Null Instance.
> +#
> +#  Caution: This module requires additional review when modified.
> +#  This library will have external input - signature.
> +#  This external input must be validated carefully to avoid security issues such
> as
> +#  buffer overflow or integer overflow.
> +#
> +#  Copyright (c) 2009 - 2019, Intel Corporation. All rights reserved.<BR>
> +#  SPDX-License-Identifier: BSD-2-Clause-Patent
> +#
> +##
> +
> +[Defines]
> +  INF_VERSION                    = 0x00010005
> +  BASE_NAME                      = BaseCryptLibNull
> +  MODULE_UNI_FILE                = BaseCryptLibNull.uni
> +  FILE_GUID                      = ba4b5ba1-0ea1-415a-896c-6caaf32146f3
> +  MODULE_TYPE                    = BASE
> +  VERSION_STRING                 = 1.0
> +  LIBRARY_CLASS                  = BaseCryptLib
> +
> +#
> +# The following information is for reference only and not required by the build
> tools.
> +#
> +#  VALID_ARCHITECTURES           = IA32 X64 ARM AARCH64
> +#
> +
> +[Sources]
> +  InternalCryptLib.h
> +  Hash/CryptMd4Null.c
> +  Hash/CryptMd5Null.c
> +  Hash/CryptSha1Null.c
> +  Hash/CryptSha256Null.c
> +  Hash/CryptSha512Null.c
> +  Hash/CryptSm3Null.c
> +  Hmac/CryptHmacMd5Null.c
> +  Hmac/CryptHmacSha1Null.c
> +  Hmac/CryptHmacSha256Null.c
> +  Cipher/CryptAesNull.c
> +  Cipher/CryptTdesNull.c
> +  Cipher/CryptArc4Null.c
> +  Pk/CryptRsaBasicNull.c
> +  Pk/CryptRsaExtNull.c
> +  Pk/CryptPkcs1OaepNull.c
> +  Pk/CryptPkcs5Pbkdf2Null.c
> +  Pk/CryptPkcs7SignNull.c
> +  Pk/CryptPkcs7VerifyNull.c
> +  Pk/CryptPkcs7VerifyEkuNull.c
> +  Pk/CryptDhNull.c
> +  Pk/CryptX509Null.c
> +  Pk/CryptAuthenticodeNull.c
> +  Pk/CryptTsNull.c
> +  Pem/CryptPemNull.c
> +  Rand/CryptRandNull.c
> +
> +[Packages]
> +  MdePkg/MdePkg.dec
> +  CryptoPkg/CryptoPkg.dec
> +
> +[LibraryClasses]
> +  DebugLib
> diff --git a/CryptoPkg/Library/BaseCryptLibNull/BaseCryptLibNull.uni
> b/CryptoPkg/Library/BaseCryptLibNull/BaseCryptLibNull.uni
> new file mode 100644
> index 0000000000..c86f612d74
> --- /dev/null
> +++ b/CryptoPkg/Library/BaseCryptLibNull/BaseCryptLibNull.uni
> @@ -0,0 +1,18 @@
> +// /** @file
> +// Cryptographic Library Null Instance.
> +//
> +// Caution: This module requires additional review when modified.
> +// This library will have external input - signature.
> +// This external input must be validated carefully to avoid security issues such
> as
> +// buffer overflow or integer overflow.
> +//
> +// Copyright (c) 2009 - 2018, Intel Corporation. All rights reserved.<BR>
> +//
> +// SPDX-License-Identifier: BSD-2-Clause-Patent
> +//
> +// **/
> +
> +#string STR_MODULE_ABSTRACT             #language en-US "Cryptographic
> Library Null Instance"
> +
> +#string STR_MODULE_DESCRIPTION          #language en-US "Caution: This is a
> null version of your crypto library and SHOULD NOT be used on any product
> ever."
> +
> diff --git a/CryptoPkg/Library/BaseCryptLibNull/Cipher/CryptAesNull.c
> b/CryptoPkg/Library/BaseCryptLibNull/Cipher/CryptAesNull.c
> new file mode 100644
> index 0000000000..a82adacf4f
> --- /dev/null
> +++ b/CryptoPkg/Library/BaseCryptLibNull/Cipher/CryptAesNull.c
> @@ -0,0 +1,159 @@
> +/** @file
> +  AES Wrapper Implementation which does not provide real capabilities.
> +
> +Copyright (c) 2012 - 2018, Intel Corporation. All rights reserved.<BR>
> +SPDX-License-Identifier: BSD-2-Clause-Patent
> +
> +**/
> +
> +#include "InternalCryptLib.h"
> +
> +/**
> +  Retrieves the size, in bytes, of the context buffer required for AES operations.
> +
> +  Return zero to indicate this interface is not supported.
> +
> +  @retval  0   This interface is not supported.
> +
> +**/
> +UINTN
> +EFIAPI
> +AesGetContextSize (
> +  VOID
> +  )
> +{
> +  ASSERT (FALSE);
> +  return 0;
> +}
> +
> +/**
> +  Initializes user-supplied memory as AES context for subsequent use.
> +
> +  Return FALSE to indicate this interface is not supported.
> +
> +  @param[out]  AesContext  Pointer to AES context being initialized.
> +  @param[in]   Key         Pointer to the user-supplied AES key.
> +  @param[in]   KeyLength   Length of AES key in bits.
> +
> +  @retval FALSE  This interface is not supported.
> +
> +**/
> +BOOLEAN
> +EFIAPI
> +AesInit (
> +  OUT  VOID         *AesContext,
> +  IN   CONST UINT8  *Key,
> +  IN   UINTN        KeyLength
> +  )
> +{
> +  ASSERT (FALSE);
> +  return FALSE;
> +}
> +
> +/**
> +  Performs AES encryption on a data buffer of the specified size in ECB mode.
> +
> +  Return FALSE to indicate this interface is not supported.
> +
> +  @param[in]   AesContext  Pointer to the AES context.
> +  @param[in]   Input       Pointer to the buffer containing the data to be
> encrypted.
> +  @param[in]   InputSize   Size of the Input buffer in bytes.
> +  @param[out]  Output      Pointer to a buffer that receives the AES encryption
> output.
> +
> +  @retval FALSE  This interface is not supported.
> +
> +**/
> +BOOLEAN
> +EFIAPI
> +AesEcbEncrypt (
> +  IN   VOID         *AesContext,
> +  IN   CONST UINT8  *Input,
> +  IN   UINTN        InputSize,
> +  OUT  UINT8        *Output
> +  )
> +{
> +  ASSERT (FALSE);
> +  return FALSE;
> +}
> +
> +/**
> +  Performs AES decryption on a data buffer of the specified size in ECB mode.
> +
> +  Return FALSE to indicate this interface is not supported.
> +
> +  @param[in]   AesContext  Pointer to the AES context.
> +  @param[in]   Input       Pointer to the buffer containing the data to be
> decrypted.
> +  @param[in]   InputSize   Size of the Input buffer in bytes.
> +  @param[out]  Output      Pointer to a buffer that receives the AES decryption
> output.
> +
> +  @retval FALSE  This interface is not supported.
> +
> +**/
> +BOOLEAN
> +EFIAPI
> +AesEcbDecrypt (
> +  IN   VOID         *AesContext,
> +  IN   CONST UINT8  *Input,
> +  IN   UINTN        InputSize,
> +  OUT  UINT8        *Output
> +  )
> +{
> +  ASSERT (FALSE);
> +  return FALSE;
> +}
> +
> +/**
> +  Performs AES encryption on a data buffer of the specified size in CBC mode.
> +
> +  Return FALSE to indicate this interface is not supported.
> +
> +  @param[in]   AesContext  Pointer to the AES context.
> +  @param[in]   Input       Pointer to the buffer containing the data to be
> encrypted.
> +  @param[in]   InputSize   Size of the Input buffer in bytes.
> +  @param[in]   Ivec        Pointer to initialization vector.
> +  @param[out]  Output      Pointer to a buffer that receives the AES encryption
> output.
> +
> +  @retval FALSE  This interface is not supported.
> +
> +**/
> +BOOLEAN
> +EFIAPI
> +AesCbcEncrypt (
> +  IN   VOID         *AesContext,
> +  IN   CONST UINT8  *Input,
> +  IN   UINTN        InputSize,
> +  IN   CONST UINT8  *Ivec,
> +  OUT  UINT8        *Output
> +  )
> +{
> +  ASSERT (FALSE);
> +  return FALSE;
> +}
> +
> +/**
> +  Performs AES decryption on a data buffer of the specified size in CBC mode.
> +
> +  Return FALSE to indicate this interface is not supported.
> +
> +  @param[in]   AesContext  Pointer to the AES context.
> +  @param[in]   Input       Pointer to the buffer containing the data to be
> encrypted.
> +  @param[in]   InputSize   Size of the Input buffer in bytes.
> +  @param[in]   Ivec        Pointer to initialization vector.
> +  @param[out]  Output      Pointer to a buffer that receives the AES encryption
> output.
> +
> +  @retval FALSE  This interface is not supported.
> +
> +**/
> +BOOLEAN
> +EFIAPI
> +AesCbcDecrypt (
> +  IN   VOID         *AesContext,
> +  IN   CONST UINT8  *Input,
> +  IN   UINTN        InputSize,
> +  IN   CONST UINT8  *Ivec,
> +  OUT  UINT8        *Output
> +  )
> +{
> +  ASSERT (FALSE);
> +  return FALSE;
> +}
> diff --git a/CryptoPkg/Library/BaseCryptLibNull/Cipher/CryptArc4Null.c
> b/CryptoPkg/Library/BaseCryptLibNull/Cipher/CryptArc4Null.c
> new file mode 100644
> index 0000000000..1f09bfa30e
> --- /dev/null
> +++ b/CryptoPkg/Library/BaseCryptLibNull/Cipher/CryptArc4Null.c
> @@ -0,0 +1,124 @@
> +/** @file
> +  ARC4 Wrapper Implementation which does not provide real capabilities.
> +
> +Copyright (c) 2012 - 2018, Intel Corporation. All rights reserved.<BR>
> +SPDX-License-Identifier: BSD-2-Clause-Patent
> +
> +**/
> +
> +#include "InternalCryptLib.h"
> +
> +/**
> +  Retrieves the size, in bytes, of the context buffer required for ARC4 operations.
> +
> +  Return zero to indicate this interface is not supported.
> +
> +  @retval  0   This interface is not supported.
> +
> +
> +**/
> +UINTN
> +EFIAPI
> +Arc4GetContextSize (
> +  VOID
> +  )
> +{
> +  ASSERT (FALSE);
> +  return 0;
> +}
> +
> +/**
> +  Initializes user-supplied memory as ARC4 context for subsequent use.
> +
> +  Return FALSE to indicate this interface is not supported.
> +
> +  @param[out]  Arc4Context  Pointer to ARC4 context being initialized.
> +  @param[in]   Key          Pointer to the user-supplied ARC4 key.
> +  @param[in]   KeySize      Size of ARC4 key in bytes.
> +
> +  @retval FALSE  This interface is not supported.
> +
> +**/
> +BOOLEAN
> +EFIAPI
> +Arc4Init (
> +  OUT  VOID         *Arc4Context,
> +  IN   CONST UINT8  *Key,
> +  IN   UINTN        KeySize
> +  )
> +{
> +  ASSERT (FALSE);
> +  return FALSE;
> +}
> +
> +/**
> +  Performs ARC4 encryption on a data buffer of the specified size.
> +
> +  Return FALSE to indicate this interface is not supported.
> +
> +  @param[in, out]  Arc4Context  Pointer to the ARC4 context.
> +  @param[in]       Input        Pointer to the buffer containing the data to be
> encrypted.
> +  @param[in]       InputSize    Size of the Input buffer in bytes.
> +  @param[out]      Output       Pointer to a buffer that receives the ARC4
> encryption output.
> +
> +  @retval FALSE  This interface is not supported.
> +
> +**/
> +BOOLEAN
> +EFIAPI
> +Arc4Encrypt (
> +  IN OUT  VOID         *Arc4Context,
> +  IN      CONST UINT8  *Input,
> +  IN      UINTN        InputSize,
> +  OUT     UINT8        *Output
> +  )
> +{
> +  ASSERT (FALSE);
> +  return FALSE;
> +}
> +
> +/**
> +  Performs ARC4 decryption on a data buffer of the specified size.
> +
> +  Return FALSE to indicate this interface is not supported.
> +
> +  @param[in, out]  Arc4Context  Pointer to the ARC4 context.
> +  @param[in]       Input        Pointer to the buffer containing the data to be
> decrypted.
> +  @param[in]       InputSize    Size of the Input buffer in bytes.
> +  @param[out]      Output       Pointer to a buffer that receives the ARC4
> decryption output.
> +
> +  @retval FALSE  This interface is not supported.
> +
> +**/
> +BOOLEAN
> +EFIAPI
> +Arc4Decrypt (
> +  IN OUT  VOID   *Arc4Context,
> +  IN      UINT8  *Input,
> +  IN      UINTN  InputSize,
> +  OUT     UINT8  *Output
> +  )
> +{
> +  ASSERT (FALSE);
> +  return FALSE;
> +}
> +
> +/**
> +  Resets the ARC4 context to the initial state.
> +
> +  Return FALSE to indicate this interface is not supported.
> +
> +  @param[in, out]  Arc4Context  Pointer to the ARC4 context.
> +
> +  @retval FALSE  This interface is not supported.
> +
> +**/
> +BOOLEAN
> +EFIAPI
> +Arc4Reset (
> +  IN OUT  VOID  *Arc4Context
> +  )
> +{
> +  ASSERT (FALSE);
> +  return FALSE;
> +}
> diff --git a/CryptoPkg/Library/BaseCryptLibNull/Cipher/CryptTdesNull.c
> b/CryptoPkg/Library/BaseCryptLibNull/Cipher/CryptTdesNull.c
> new file mode 100644
> index 0000000000..efa2716063
> --- /dev/null
> +++ b/CryptoPkg/Library/BaseCryptLibNull/Cipher/CryptTdesNull.c
> @@ -0,0 +1,160 @@
> +/** @file
> +  TDES Wrapper Implementation which does not provide real capabilities.
> +
> +Copyright (c) 2012, Intel Corporation. All rights reserved.<BR>
> +SPDX-License-Identifier: BSD-2-Clause-Patent
> +
> +**/
> +
> +#include "InternalCryptLib.h"
> +
> +/**
> +  Retrieves the size, in bytes, of the context buffer required for TDES operations.
> +
> +  Return zero to indicate this interface is not supported.
> +
> +  @retval  0   This interface is not supported.
> +
> +**/
> +UINTN
> +EFIAPI
> +TdesGetContextSize (
> +  VOID
> +  )
> +{
> +  ASSERT (FALSE);
> +  return 0;
> +}
> +
> +/**
> +  Initializes user-supplied memory as TDES context for subsequent use.
> +
> +  Return FALSE to indicate this interface is not supported.
> +
> +  @param[out]  TdesContext  Pointer to TDES context being initialized.
> +  @param[in]   Key          Pointer to the user-supplied TDES key.
> +  @param[in]   KeyLength    Length of TDES key in bits.
> +
> +  @retval FALSE  This interface is not supported.
> +
> +**/
> +BOOLEAN
> +EFIAPI
> +TdesInit (
> +  OUT  VOID         *TdesContext,
> +  IN   CONST UINT8  *Key,
> +  IN   UINTN        KeyLength
> +  )
> +{
> +  ASSERT (FALSE);
> +  return FALSE;
> +}
> +
> +/**
> +  Performs TDES encryption on a data buffer of the specified size in ECB mode.
> +
> +  Return FALSE to indicate this interface is not supported.
> +
> +  @param[in]   TdesContext  Pointer to the TDES context.
> +  @param[in]   Input        Pointer to the buffer containing the data to be
> encrypted.
> +  @param[in]   InputSize    Size of the Input buffer in bytes.
> +  @param[out]  Output       Pointer to a buffer that receives the TDES encryption
> output.
> +
> +  @retval FALSE  This interface is not supported.
> +
> +**/
> +BOOLEAN
> +EFIAPI
> +TdesEcbEncrypt (
> +  IN   VOID         *TdesContext,
> +  IN   CONST UINT8  *Input,
> +  IN   UINTN        InputSize,
> +  OUT  UINT8        *Output
> +  )
> +{
> +  ASSERT (FALSE);
> +  return FALSE;
> +}
> +
> +/**
> +  Performs TDES decryption on a data buffer of the specified size in ECB mode.
> +
> +  Return FALSE to indicate this interface is not supported.
> +
> +  @param[in]   TdesContext  Pointer to the TDES context.
> +  @param[in]   Input        Pointer to the buffer containing the data to be
> decrypted.
> +  @param[in]   InputSize    Size of the Input buffer in bytes.
> +  @param[out]  Output       Pointer to a buffer that receives the TDES decryption
> output.
> +
> +  @retval FALSE  This interface is not supported.
> +
> +**/
> +BOOLEAN
> +EFIAPI
> +TdesEcbDecrypt (
> +  IN   VOID         *TdesContext,
> +  IN   CONST UINT8  *Input,
> +  IN   UINTN        InputSize,
> +  OUT  UINT8        *Output
> +  )
> +{
> +  ASSERT (FALSE);
> +  return FALSE;
> +}
> +
> +/**
> +  Performs TDES encryption on a data buffer of the specified size in CBC mode.
> +
> +  Return FALSE to indicate this interface is not supported.
> +
> +  @param[in]   TdesContext  Pointer to the TDES context.
> +  @param[in]   Input        Pointer to the buffer containing the data to be
> encrypted.
> +  @param[in]   InputSize    Size of the Input buffer in bytes.
> +  @param[in]   Ivec         Pointer to initialization vector.
> +  @param[out]  Output       Pointer to a buffer that receives the TDES encryption
> output.
> +
> +  @retval FALSE  This interface is not supported.
> +
> +**/
> +BOOLEAN
> +EFIAPI
> +TdesCbcEncrypt (
> +  IN   VOID         *TdesContext,
> +  IN   CONST UINT8  *Input,
> +  IN   UINTN        InputSize,
> +  IN   CONST UINT8  *Ivec,
> +  OUT  UINT8        *Output
> +  )
> +{
> +  ASSERT (FALSE);
> +  return FALSE;
> +}
> +
> +/**
> +  Performs TDES decryption on a data buffer of the specified size in CBC mode.
> +
> +  Return FALSE to indicate this interface is not supported.
> +
> +  @param[in]   TdesContext  Pointer to the TDES context.
> +  @param[in]   Input        Pointer to the buffer containing the data to be
> encrypted.
> +  @param[in]   InputSize    Size of the Input buffer in bytes.
> +  @param[in]   Ivec         Pointer to initialization vector.
> +  @param[out]  Output       Pointer to a buffer that receives the TDES encryption
> output.
> +
> +  @retval FALSE  This interface is not supported.
> +
> +**/
> +BOOLEAN
> +EFIAPI
> +TdesCbcDecrypt (
> +  IN   VOID         *TdesContext,
> +  IN   CONST UINT8  *Input,
> +  IN   UINTN        InputSize,
> +  IN   CONST UINT8  *Ivec,
> +  OUT  UINT8        *Output
> +  )
> +{
> +  ASSERT (FALSE);
> +  return FALSE;
> +}
> +
> diff --git a/CryptoPkg/Library/BaseCryptLibNull/Hash/CryptMd4Null.c
> b/CryptoPkg/Library/BaseCryptLibNull/Hash/CryptMd4Null.c
> new file mode 100644
> index 0000000000..610c61c713
> --- /dev/null
> +++ b/CryptoPkg/Library/BaseCryptLibNull/Hash/CryptMd4Null.c
> @@ -0,0 +1,143 @@
> +/** @file
> +  MD4 Digest Wrapper Implementation which does not provide real capabilities.
> +
> +Copyright (c) 2012 - 2018, Intel Corporation. All rights reserved.<BR>
> +SPDX-License-Identifier: BSD-2-Clause-Patent
> +
> +**/
> +
> +#include "InternalCryptLib.h"
> +
> +/**
> +  Retrieves the size, in bytes, of the context buffer required for MD4 hash
> +  operations.
> +
> +  Return zero to indicate this interface is not supported.
> +
> +  @retval  0   This interface is not supported.
> +
> +**/
> +UINTN
> +EFIAPI
> +Md4GetContextSize (
> +  VOID
> +  )
> +{
> +  ASSERT (FALSE);
> +  return 0;
> +}
> +
> +/**
> +  Initializes user-supplied memory pointed by Md4Context as MD4 hash context
> for
> +  subsequent use.
> +
> +  Return FALSE to indicate this interface is not supported.
> +
> +  @param[out]  Md4Context  Pointer to MD4 context being initialized.
> +
> +  @retval FALSE  This interface is not supported.
> +
> +**/
> +BOOLEAN
> +EFIAPI
> +Md4Init (
> +  OUT  VOID  *Md4Context
> +  )
> +{
> +  ASSERT (FALSE);
> +  return FALSE;
> +}
> +
> +/**
> +  Makes a copy of an existing MD4 context.
> +
> +  Return FALSE to indicate this interface is not supported.
> +
> +  @param[in]  Md4Context     Pointer to MD4 context being copied.
> +  @param[out] NewMd4Context  Pointer to new MD4 context.
> +
> +  @retval FALSE  This interface is not supported.
> +
> +**/
> +BOOLEAN
> +EFIAPI
> +Md4Duplicate (
> +  IN   CONST VOID  *Md4Context,
> +  OUT  VOID        *NewMd4Context
> +  )
> +{
> +  ASSERT (FALSE);
> +  return FALSE;
> +}
> +
> +/**
> +  Digests the input data and updates MD4 context.
> +
> +  Return FALSE to indicate this interface is not supported.
> +
> +  @param[in, out]  Md4Context  Pointer to the MD4 context.
> +  @param[in]       Data        Pointer to the buffer containing the data to be
> hashed.
> +  @param[in]       DataSize    Size of Data buffer in bytes.
> +
> +  @retval FALSE  This interface is not supported.
> +
> +**/
> +BOOLEAN
> +EFIAPI
> +Md4Update (
> +  IN OUT  VOID        *Md4Context,
> +  IN      CONST VOID  *Data,
> +  IN      UINTN       DataSize
> +  )
> +{
> +  ASSERT (FALSE);
> +  return FALSE;
> +}
> +
> +/**
> +  Completes computation of the MD4 digest value.
> +
> +  Return FALSE to indicate this interface is not supported.
> +
> +  @param[in, out]  Md4Context  Pointer to the MD4 context.
> +  @param[out]      HashValue   Pointer to a buffer that receives the MD4 digest
> +                               value (16 bytes).
> +
> +  @retval FALSE  This interface is not supported.
> +
> +**/
> +BOOLEAN
> +EFIAPI
> +Md4Final (
> +  IN OUT  VOID   *Md4Context,
> +  OUT     UINT8  *HashValue
> +  )
> +{
> +  ASSERT (FALSE);
> +  return FALSE;
> +}
> +
> +/**
> +  Computes the MD4 message digest of a input data buffer.
> +
> +  Return FALSE to indicate this interface is not supported.
> +
> +  @param[in]   Data        Pointer to the buffer containing the data to be hashed.
> +  @param[in]   DataSize    Size of Data buffer in bytes.
> +  @param[out]  HashValue   Pointer to a buffer that receives the MD4 digest
> +                           value (16 bytes).
> +
> +  @retval FALSE  This interface is not supported.
> +
> +**/
> +BOOLEAN
> +EFIAPI
> +Md4HashAll (
> +  IN   CONST VOID  *Data,
> +  IN   UINTN       DataSize,
> +  OUT  UINT8       *HashValue
> +  )
> +{
> +  ASSERT (FALSE);
> +  return FALSE;
> +}
> diff --git a/CryptoPkg/Library/BaseCryptLibNull/Hash/CryptMd5Null.c
> b/CryptoPkg/Library/BaseCryptLibNull/Hash/CryptMd5Null.c
> new file mode 100644
> index 0000000000..34c539fe3a
> --- /dev/null
> +++ b/CryptoPkg/Library/BaseCryptLibNull/Hash/CryptMd5Null.c
> @@ -0,0 +1,165 @@
> +/** @file
> +
> +MD5 Digest Wrapper Null Implementation.
> +
> +Copyright (c) Microsoft Corporation. All rights reserved.
> +SPDX-License-Identifier: BSD-2-Clause-Patent
> +
> +**/
> +
> +#include "InternalCryptLib.h"
> +
> +
> +/**
> +  Retrieves the size, in bytes, of the context buffer required for MD5 hash
> operations.
> +
> +  @return  The size, in bytes, of the context buffer required for MD5 hash
> operations.
> +
> +**/
> +UINTN
> +EFIAPI
> +Md5GetContextSize (
> +  VOID
> +  )
> +{
> +  ASSERT (FALSE);
> +  return 0;
> +}
> +
> +
> +/**
> +  Initializes user-supplied memory pointed by Md5Context as MD5 hash context
> for
> +  subsequent use.
> +
> +  If Md5Context is NULL, then return FALSE.
> +
> +  @param[out]  Md5Context  Pointer to MD5 context being initialized.
> +
> +  @retval TRUE   MD5 context initialization succeeded.
> +  @retval FALSE  MD5 context initialization failed.
> +
> +**/
> +BOOLEAN
> +EFIAPI
> +Md5Init (
> +  OUT  VOID  *Md5Context
> +  )
> +{
> +  ASSERT (FALSE);
> +  return FALSE;
> +}
> +
> +/**
> +  Makes a copy of an existing MD5 context.
> +
> +  If Md5Context is NULL, then return FALSE.
> +  If NewMd5Context is NULL, then return FALSE.
> +
> +  @param[in]  Md5Context     Pointer to MD5 context being copied.
> +  @param[out] NewMd5Context  Pointer to new MD5 context.
> +
> +  @retval TRUE   MD5 context copy succeeded.
> +  @retval FALSE  MD5 context copy failed.
> +
> +**/
> +BOOLEAN
> +EFIAPI
> +Md5Duplicate (
> +  IN   CONST VOID  *Md5Context,
> +  OUT  VOID        *NewMd5Context
> +  )
> +{
> +  ASSERT (FALSE);
> +  return FALSE;
> +}
> +
> +/**
> +  Digests the input data and updates MD5 context.
> +
> +  This function performs MD5 digest on a data buffer of the specified size.
> +  It can be called multiple times to compute the digest of long or discontinuous
> data streams.
> +  MD5 context should be already correctly intialized by Md5Init(), and should
> not be finalized
> +  by Md5Final(). Behavior with invalid context is undefined.
> +
> +  If Md5Context is NULL, then return FALSE.
> +
> +  @param[in, out]  Md5Context  Pointer to the MD5 context.
> +  @param[in]       Data        Pointer to the buffer containing the data to be
> hashed.
> +  @param[in]       DataSize    Size of Data buffer in bytes.
> +
> +  @retval TRUE   MD5 data digest succeeded.
> +  @retval FALSE  MD5 data digest failed.
> +
> +**/
> +BOOLEAN
> +EFIAPI
> +Md5Update (
> +  IN OUT  VOID        *Md5Context,
> +  IN      CONST VOID  *Data,
> +  IN      UINTN       DataSize
> +  )
> +{
> +  ASSERT (FALSE);
> +  return FALSE;
> +}
> +
> +/**
> +  Completes computation of the MD5 digest value.
> +
> +  This function completes MD5 hash computation and retrieves the digest value
> into
> +  the specified memory. After this function has been called, the MD5 context
> cannot
> +  be used again.
> +  MD5 context should be already correctly intialized by Md5Init(), and should
> not be
> +  finalized by Md5Final(). Behavior with invalid MD5 context is undefined.
> +
> +  If Md5Context is NULL, then return FALSE.
> +  If HashValue is NULL, then return FALSE.
> +
> +  @param[in, out]  Md5Context  Pointer to the MD5 context.
> +  @param[out]      HashValue   Pointer to a buffer that receives the MD5 digest
> +                               value (16 bytes).
> +
> +  @retval TRUE   MD5 digest computation succeeded.
> +  @retval FALSE  MD5 digest computation failed.
> +
> +**/
> +BOOLEAN
> +EFIAPI
> +Md5Final (
> +  IN OUT  VOID   *Md5Context,
> +  OUT     UINT8  *HashValue
> +  )
> +{
> +  ASSERT (FALSE);
> +  return FALSE;
> +}
> +
> +/**
> +Computes the MD5 message digest of a input data buffer.
> +
> +This function performs the MD5 message digest of a given data buffer, and
> places
> +the digest value into the specified memory.
> +
> +If this interface is not supported, then return FALSE.
> +
> +@param[in]   Data        Pointer to the buffer containing the data to be hashed.
> +@param[in]   DataSize    Size of Data buffer in bytes.
> +@param[out]  HashValue   Pointer to a buffer that receives the MD5 digest
> +value (16 bytes).
> +
> +@retval TRUE   MD5 digest computation succeeded.
> +@retval FALSE  MD5 digest computation failed.
> +@retval FALSE  This interface is not supported.
> +
> +**/
> +BOOLEAN
> +EFIAPI
> +Md5HashAll(
> +  IN   CONST VOID  *Data,
> +  IN   UINTN       DataSize,
> +  OUT  UINT8       *HashValue
> +)
> +{
> +  ASSERT(FALSE);
> +  return FALSE;
> +}
> diff --git a/CryptoPkg/Library/BaseCryptLibNull/Hash/CryptSha1Null.c
> b/CryptoPkg/Library/BaseCryptLibNull/Hash/CryptSha1Null.c
> new file mode 100644
> index 0000000000..c2f4d30f83
> --- /dev/null
> +++ b/CryptoPkg/Library/BaseCryptLibNull/Hash/CryptSha1Null.c
> @@ -0,0 +1,167 @@
> +/** @file
> +  SHA-1 Digest Wrapper Null Implementation.
> +
> +Copyright (c) 2009 - 2016, Intel Corporation. All rights reserved.<BR>
> +SPDX-License-Identifier: BSD-2-Clause-Patent
> +
> +**/
> +
> +#include "InternalCryptLib.h"
> +
> +
> +/**
> +  Retrieves the size, in bytes, of the context buffer required for SHA-1 hash
> operations.
> +
> +  @return  The size, in bytes, of the context buffer required for SHA-1 hash
> operations.
> +
> +**/
> +UINTN
> +EFIAPI
> +Sha1GetContextSize (
> +  VOID
> +  )
> +{
> +  //
> +  // Retrieves SHA Context Size
> +  //
> +  ASSERT (FALSE);
> +  return 0;
> +}
> +
> +/**
> +  Initializes user-supplied memory pointed by Sha1Context as SHA-1 hash
> context for
> +  subsequent use.
> +
> +  If Sha1Context is NULL, then return FALSE.
> +
> +  @param[out]  Sha1Context  Pointer to SHA-1 context being initialized.
> +
> +  @retval TRUE   SHA-1 context initialization succeeded.
> +  @retval FALSE  SHA-1 context initialization failed.
> +
> +**/
> +BOOLEAN
> +EFIAPI
> +Sha1Init (
> +  OUT  VOID  *Sha1Context
> +  )
> +{
> +  ASSERT (FALSE);
> +  return FALSE;
> +}
> +
> +/**
> +  Makes a copy of an existing SHA-1 context.
> +
> +  If Sha1Context is NULL, then return FALSE.
> +  If NewSha1Context is NULL, then return FALSE.
> +
> +  @param[in]  Sha1Context     Pointer to SHA-1 context being copied.
> +  @param[out] NewSha1Context  Pointer to new SHA-1 context.
> +
> +  @retval TRUE   SHA-1 context copy succeeded.
> +  @retval FALSE  SHA-1 context copy failed.
> +
> +**/
> +BOOLEAN
> +EFIAPI
> +Sha1Duplicate (
> +  IN   CONST VOID  *Sha1Context,
> +  OUT  VOID        *NewSha1Context
> +  )
> +{
> +  ASSERT (FALSE);
> +
> +  return FALSE;
> +}
> +
> +/**
> +  Digests the input data and updates SHA-1 context.
> +
> +  This function performs SHA-1 digest on a data buffer of the specified size.
> +  It can be called multiple times to compute the digest of long or discontinuous
> data streams.
> +  SHA-1 context should be already correctly initialized by Sha1Init(), and should
> not be finalized
> +  by Sha1Final(). Behavior with invalid context is undefined.
> +
> +  If Sha1Context is NULL, then return FALSE.
> +
> +  @param[in, out]  Sha1Context  Pointer to the SHA-1 context.
> +  @param[in]       Data         Pointer to the buffer containing the data to be
> hashed.
> +  @param[in]       DataSize     Size of Data buffer in bytes.
> +
> +  @retval TRUE   SHA-1 data digest succeeded.
> +  @retval FALSE  SHA-1 data digest failed.
> +
> +**/
> +BOOLEAN
> +EFIAPI
> +Sha1Update (
> +  IN OUT  VOID        *Sha1Context,
> +  IN      CONST VOID  *Data,
> +  IN      UINTN       DataSize
> +  )
> +{
> +  ASSERT (FALSE);
> +  return FALSE;
> +}
> +
> +/**
> +  Completes computation of the SHA-1 digest value.
> +
> +  This function completes SHA-1 hash computation and retrieves the digest
> value into
> +  the specified memory. After this function has been called, the SHA-1 context
> cannot
> +  be used again.
> +  SHA-1 context should be already correctly initialized by Sha1Init(), and should
> not be
> +  finalized by Sha1Final(). Behavior with invalid SHA-1 context is undefined.
> +
> +  If Sha1Context is NULL, then return FALSE.
> +  If HashValue is NULL, then return FALSE.
> +
> +  @param[in, out]  Sha1Context  Pointer to the SHA-1 context.
> +  @param[out]      HashValue    Pointer to a buffer that receives the SHA-1
> digest
> +                                value (20 bytes).
> +
> +  @retval TRUE   SHA-1 digest computation succeeded.
> +  @retval FALSE  SHA-1 digest computation failed.
> +
> +**/
> +BOOLEAN
> +EFIAPI
> +Sha1Final (
> +  IN OUT  VOID   *Sha1Context,
> +  OUT     UINT8  *HashValue
> +  )
> +{
> +  ASSERT (FALSE);
> +  return FALSE;
> +}
> +
> +/**
> +  Computes the SHA-1 message digest of a input data buffer.
> +
> +  This function performs the SHA-1 message digest of a given data buffer, and
> places
> +  the digest value into the specified memory.
> +
> +  If this interface is not supported, then return FALSE.
> +
> +  @param[in]   Data        Pointer to the buffer containing the data to be hashed.
> +  @param[in]   DataSize    Size of Data buffer in bytes.
> +  @param[out]  HashValue   Pointer to a buffer that receives the SHA-1 digest
> +                           value (20 bytes).
> +
> +  @retval TRUE   SHA-1 digest computation succeeded.
> +  @retval FALSE  SHA-1 digest computation failed.
> +  @retval FALSE  This interface is not supported.
> +
> +**/
> +BOOLEAN
> +EFIAPI
> +Sha1HashAll (
> +  IN   CONST VOID  *Data,
> +  IN   UINTN       DataSize,
> +  OUT  UINT8       *HashValue
> +  )
> +{
> +  ASSERT (FALSE);
> +  return FALSE;
> +}
> diff --git a/CryptoPkg/Library/BaseCryptLibNull/Hash/CryptSha256Null.c
> b/CryptoPkg/Library/BaseCryptLibNull/Hash/CryptSha256Null.c
> new file mode 100644
> index 0000000000..cf994e8e06
> --- /dev/null
> +++ b/CryptoPkg/Library/BaseCryptLibNull/Hash/CryptSha256Null.c
> @@ -0,0 +1,162 @@
> +/** @file
> +  SHA-256 Digest Wrapper Null Implementation.
> +
> +Copyright (c) 2009 - 2016, Intel Corporation. All rights reserved.<BR>
> +SPDX-License-Identifier: BSD-2-Clause-Patent
> +
> +**/
> +
> +#include "InternalCryptLib.h"
> +
> +/**
> +  Retrieves the size, in bytes, of the context buffer required for SHA-256 hash
> operations.
> +
> +  @return  The size, in bytes, of the context buffer required for SHA-256 hash
> operations.
> +
> +**/
> +UINTN
> +EFIAPI
> +Sha256GetContextSize (
> +  VOID
> +  )
> +{
> +  ASSERT (FALSE);
> +  return 0;
> +}
> +
> +/**
> +  Initializes user-supplied memory pointed by Sha256Context as SHA-256 hash
> context for
> +  subsequent use.
> +
> +  If Sha256Context is NULL, then return FALSE.
> +
> +  @param[out]  Sha256Context  Pointer to SHA-256 context being initialized.
> +
> +  @retval TRUE   SHA-256 context initialization succeeded.
> +  @retval FALSE  SHA-256 context initialization failed.
> +
> +**/
> +BOOLEAN
> +EFIAPI
> +Sha256Init (
> +  OUT  VOID  *Sha256Context
> +  )
> +{
> +  ASSERT (FALSE);
> +  return FALSE;
> +}
> +
> +/**
> +  Makes a copy of an existing SHA-256 context.
> +
> +  If Sha256Context is NULL, then return FALSE.
> +  If NewSha256Context is NULL, then return FALSE.
> +
> +  @param[in]  Sha256Context     Pointer to SHA-256 context being copied.
> +  @param[out] NewSha256Context  Pointer to new SHA-256 context.
> +
> +  @retval TRUE   SHA-256 context copy succeeded.
> +  @retval FALSE  SHA-256 context copy failed.
> +
> +**/
> +BOOLEAN
> +EFIAPI
> +Sha256Duplicate (
> +  IN   CONST VOID  *Sha256Context,
> +  OUT  VOID        *NewSha256Context
> +  )
> +{
> +  ASSERT (FALSE);
> +  return FALSE;
> +}
> +
> +/**
> +  Digests the input data and updates SHA-256 context.
> +
> +  This function performs SHA-256 digest on a data buffer of the specified size.
> +  It can be called multiple times to compute the digest of long or discontinuous
> data streams.
> +  SHA-256 context should be already correctly initialized by Sha256Init(), and
> should not be finalized
> +  by Sha256Final(). Behavior with invalid context is undefined.
> +
> +  If Sha256Context is NULL, then return FALSE.
> +
> +  @param[in, out]  Sha256Context  Pointer to the SHA-256 context.
> +  @param[in]       Data           Pointer to the buffer containing the data to be
> hashed.
> +  @param[in]       DataSize       Size of Data buffer in bytes.
> +
> +  @retval TRUE   SHA-256 data digest succeeded.
> +  @retval FALSE  SHA-256 data digest failed.
> +
> +**/
> +BOOLEAN
> +EFIAPI
> +Sha256Update (
> +  IN OUT  VOID        *Sha256Context,
> +  IN      CONST VOID  *Data,
> +  IN      UINTN       DataSize
> +  )
> +{
> +  ASSERT (FALSE);
> +  return FALSE;
> +}
> +
> +/**
> +  Completes computation of the SHA-256 digest value.
> +
> +  This function completes SHA-256 hash computation and retrieves the digest
> value into
> +  the specified memory. After this function has been called, the SHA-256
> context cannot
> +  be used again.
> +  SHA-256 context should be already correctly initialized by Sha256Init(), and
> should not be
> +  finalized by Sha256Final(). Behavior with invalid SHA-256 context is undefined.
> +
> +  If Sha256Context is NULL, then return FALSE.
> +  If HashValue is NULL, then return FALSE.
> +
> +  @param[in, out]  Sha256Context  Pointer to the SHA-256 context.
> +  @param[out]      HashValue      Pointer to a buffer that receives the SHA-256
> digest
> +                                  value (32 bytes).
> +
> +  @retval TRUE   SHA-256 digest computation succeeded.
> +  @retval FALSE  SHA-256 digest computation failed.
> +
> +**/
> +BOOLEAN
> +EFIAPI
> +Sha256Final (
> +  IN OUT  VOID   *Sha256Context,
> +  OUT     UINT8  *HashValue
> +  )
> +{
> +  ASSERT (FALSE);
> +  return FALSE;
> +}
> +
> +/**
> +  Computes the SHA-256 message digest of a input data buffer.
> +
> +  This function performs the SHA-256 message digest of a given data buffer,
> and places
> +  the digest value into the specified memory.
> +
> +  If this interface is not supported, then return FALSE.
> +
> +  @param[in]   Data        Pointer to the buffer containing the data to be hashed.
> +  @param[in]   DataSize    Size of Data buffer in bytes.
> +  @param[out]  HashValue   Pointer to a buffer that receives the SHA-256
> digest
> +                           value (32 bytes).
> +
> +  @retval TRUE   SHA-256 digest computation succeeded.
> +  @retval FALSE  SHA-256 digest computation failed.
> +  @retval FALSE  This interface is not supported.
> +
> +**/
> +BOOLEAN
> +EFIAPI
> +Sha256HashAll (
> +  IN   CONST VOID  *Data,
> +  IN   UINTN       DataSize,
> +  OUT  UINT8       *HashValue
> +  )
> +{
> +  ASSERT (FALSE);
> +  return FALSE;
> +}
> diff --git a/CryptoPkg/Library/BaseCryptLibNull/Hash/CryptSha512Null.c
> b/CryptoPkg/Library/BaseCryptLibNull/Hash/CryptSha512Null.c
> new file mode 100644
> index 0000000000..a6c861d7d1
> --- /dev/null
> +++ b/CryptoPkg/Library/BaseCryptLibNull/Hash/CryptSha512Null.c
> @@ -0,0 +1,275 @@
> +/** @file
> +  SHA-384 and SHA-512 Digest Wrapper Implementations which does not
> provide real capabilities.
> +
> +Copyright (c) 2014 - 2016, Intel Corporation. All rights reserved.<BR>
> +SPDX-License-Identifier: BSD-2-Clause-Patent
> +
> +**/
> +
> +#include "InternalCryptLib.h"
> +
> +/**
> +  Retrieves the size, in bytes, of the context buffer required for SHA-384 hash
> operations.
> +
> +  Return zero to indicate this interface is not supported.
> +
> +  @retval  0   This interface is not supported.
> +
> +**/
> +UINTN
> +EFIAPI
> +Sha384GetContextSize (
> +  VOID
> +  )
> +{
> +  ASSERT (FALSE);
> +  return 0;
> +}
> +
> +/**
> +  Initializes user-supplied memory pointed by Sha384Context as SHA-384 hash
> context for
> +  subsequent use.
> +
> +  Return FALSE to indicate this interface is not supported.
> +
> +  @param[out]  Sha384Context  Pointer to SHA-384 context being initialized.
> +
> +  @retval FALSE  This interface is not supported.
> +
> +**/
> +BOOLEAN
> +EFIAPI
> +Sha384Init (
> +  OUT  VOID  *Sha384Context
> +  )
> +{
> +  ASSERT (FALSE);
> +  return FALSE;
> +}
> +
> +/**
> +  Makes a copy of an existing SHA-384 context.
> +
> +  Return FALSE to indicate this interface is not supported.
> +
> +  @param[in]  Sha384Context     Pointer to SHA-384 context being copied.
> +  @param[out] NewSha384Context  Pointer to new SHA-384 context.
> +
> +  @retval FALSE  This interface is not supported.
> +
> +**/
> +BOOLEAN
> +EFIAPI
> +Sha384Duplicate (
> +  IN   CONST VOID  *Sha384Context,
> +  OUT  VOID        *NewSha384Context
> +  )
> +{
> +  ASSERT (FALSE);
> +  return FALSE;
> +}
> +
> +/**
> +  Digests the input data and updates SHA-384 context.
> +
> +  Return FALSE to indicate this interface is not supported.
> +
> +  @param[in, out]  Sha384Context  Pointer to the SHA-384 context.
> +  @param[in]       Data           Pointer to the buffer containing the data to be
> hashed.
> +  @param[in]       DataSize       Size of Data buffer in bytes.
> +
> +  @retval FALSE  This interface is not supported.
> +
> +**/
> +BOOLEAN
> +EFIAPI
> +Sha384Update (
> +  IN OUT  VOID        *Sha384Context,
> +  IN      CONST VOID  *Data,
> +  IN      UINTN       DataSize
> +  )
> +{
> +  ASSERT (FALSE);
> +  return FALSE;
> +}
> +
> +/**
> +  Completes computation of the SHA-384 digest value.
> +
> +  Return FALSE to indicate this interface is not supported.
> +
> +  @param[in, out]  Sha384Context  Pointer to the SHA-384 context.
> +  @param[out]      HashValue      Pointer to a buffer that receives the SHA-384
> digest
> +                                  value (48 bytes).
> +
> +  @retval FALSE  This interface is not supported.
> +
> +**/
> +BOOLEAN
> +EFIAPI
> +Sha384Final (
> +  IN OUT  VOID   *Sha384Context,
> +  OUT     UINT8  *HashValue
> +  )
> +{
> +  ASSERT (FALSE);
> +  return FALSE;
> +}
> +
> +/**
> +  Computes the SHA-384 message digest of a input data buffer.
> +
> +  Return FALSE to indicate this interface is not supported.
> +
> +  @param[in]   Data        Pointer to the buffer containing the data to be hashed.
> +  @param[in]   DataSize    Size of Data buffer in bytes.
> +  @param[out]  HashValue   Pointer to a buffer that receives the SHA-384
> digest
> +                           value (48 bytes).
> +
> +  @retval FALSE  This interface is not supported.
> +
> +**/
> +BOOLEAN
> +EFIAPI
> +Sha384HashAll (
> +  IN   CONST VOID  *Data,
> +  IN   UINTN       DataSize,
> +  OUT  UINT8       *HashValue
> +  )
> +{
> +  ASSERT (FALSE);
> +  return FALSE;
> +}
> +
> +/**
> +  Retrieves the size, in bytes, of the context buffer required for SHA-512 hash
> operations.
> +
> +  Return zero to indicate this interface is not supported.
> +
> +  @retval  0   This interface is not supported.
> +
> +**/
> +UINTN
> +EFIAPI
> +Sha512GetContextSize (
> +  VOID
> +  )
> +{
> +  ASSERT (FALSE);
> +  return 0;
> +}
> +
> +/**
> +  Initializes user-supplied memory pointed by Sha512Context as SHA-512 hash
> context for
> +  subsequent use.
> +
> +  Return FALSE to indicate this interface is not supported.
> +
> +  @param[out]  Sha512Context  Pointer to SHA-512 context being initialized.
> +
> +  @retval FALSE  This interface is not supported.
> +
> +**/
> +BOOLEAN
> +EFIAPI
> +Sha512Init (
> +  OUT  VOID  *Sha512Context
> +  )
> +{
> +  ASSERT (FALSE);
> +  return FALSE;
> +}
> +
> +/**
> +  Makes a copy of an existing SHA-512 context.
> +
> +  Return FALSE to indicate this interface is not supported.
> +
> +  @param[in]  Sha512Context     Pointer to SHA-512 context being copied.
> +  @param[out] NewSha512Context  Pointer to new SHA-512 context.
> +
> +  @retval FALSE  This interface is not supported.
> +
> +**/
> +BOOLEAN
> +EFIAPI
> +Sha512Duplicate (
> +  IN   CONST VOID  *Sha512Context,
> +  OUT  VOID        *NewSha512Context
> +  )
> +{
> +  ASSERT (FALSE);
> +  return FALSE;
> +}
> +
> +/**
> +  Digests the input data and updates SHA-512 context.
> +
> +  Return FALSE to indicate this interface is not supported.
> +
> +  @param[in, out]  Sha512Context  Pointer to the SHA-512 context.
> +  @param[in]       Data           Pointer to the buffer containing the data to be
> hashed.
> +  @param[in]       DataSize       Size of Data buffer in bytes.
> +
> +  @retval FALSE  This interface is not supported.
> +
> +**/
> +BOOLEAN
> +EFIAPI
> +Sha512Update (
> +  IN OUT  VOID        *Sha512Context,
> +  IN      CONST VOID  *Data,
> +  IN      UINTN       DataSize
> +  )
> +{
> +  ASSERT (FALSE);
> +  return FALSE;
> +}
> +
> +/**
> +  Completes computation of the SHA-512 digest value.
> +
> +  Return FALSE to indicate this interface is not supported.
> +
> +  @param[in, out]  Sha512Context  Pointer to the SHA-512 context.
> +  @param[out]      HashValue      Pointer to a buffer that receives the SHA-512
> digest
> +                                  value (64 bytes).
> +
> +  @retval FALSE  This interface is not supported.
> +
> +**/
> +BOOLEAN
> +EFIAPI
> +Sha512Final (
> +  IN OUT  VOID   *Sha512Context,
> +  OUT     UINT8  *HashValue
> +  )
> +{
> +  ASSERT (FALSE);
> +  return FALSE;
> +}
> +
> +/**
> +  Computes the SHA-512 message digest of a input data buffer.
> +
> +  Return FALSE to indicate this interface is not supported.
> +
> +  @param[in]   Data        Pointer to the buffer containing the data to be hashed.
> +  @param[in]   DataSize    Size of Data buffer in bytes.
> +  @param[out]  HashValue   Pointer to a buffer that receives the SHA-512
> digest
> +                           value (64 bytes).
> +
> +  @retval FALSE  This interface is not supported.
> +
> +**/
> +BOOLEAN
> +EFIAPI
> +Sha512HashAll (
> +  IN   CONST VOID  *Data,
> +  IN   UINTN       DataSize,
> +  OUT  UINT8       *HashValue
> +  )
> +{
> +  ASSERT (FALSE);
> +  return FALSE;
> +}
> diff --git a/CryptoPkg/Library/BaseCryptLibNull/Hash/CryptSm3Null.c
> b/CryptoPkg/Library/BaseCryptLibNull/Hash/CryptSm3Null.c
> new file mode 100644
> index 0000000000..0f3c89b465
> --- /dev/null
> +++ b/CryptoPkg/Library/BaseCryptLibNull/Hash/CryptSm3Null.c
> @@ -0,0 +1,164 @@
> +/** @file
> +  SM3 Digest Wrapper Null Implementation.
> +
> +Copyright (c) 2019, Intel Corporation. All rights reserved.<BR>
> +SPDX-License-Identifier: BSD-2-Clause-Patent
> +
> +**/
> +
> +#include "InternalCryptLib.h"
> +
> +/**
> +  Retrieves the size, in bytes, of the context buffer required for SM3 hash
> operations.
> +
> +  @return  The size, in bytes, of the context buffer required for SM3 hash
> operations.
> +
> +**/
> +UINTN
> +EFIAPI
> +Sm3GetContextSize (
> +  VOID
> +  )
> +{
> +  ASSERT (FALSE);
> +  return 0;
> +}
> +
> +/**
> +  Initializes user-supplied memory pointed by Sm3Context as SM3 hash context
> for
> +  subsequent use.
> +
> +  If Sm3Context is NULL, then return FALSE.
> +
> +  @param[out]  Sm3Context  Pointer to SM3 context being initialized.
> +
> +  @retval TRUE   SM3 context initialization succeeded.
> +  @retval FALSE  SM3 context initialization failed.
> +
> +**/
> +BOOLEAN
> +EFIAPI
> +Sm3Init (
> +  OUT  VOID  *Sm3Context
> +  )
> +{
> +  ASSERT (FALSE);
> +  return FALSE;
> +}
> +
> +/**
> +  Makes a copy of an existing SM3 context.
> +
> +  If Sm3Context is NULL, then return FALSE.
> +  If NewSm3Context is NULL, then return FALSE.
> +  If this interface is not supported, then return FALSE.
> +
> +  @param[in]  Sm3Context     Pointer to SM3 context being copied.
> +  @param[out] NewSm3Context  Pointer to new SM3 context.
> +
> +  @retval TRUE   SM3 context copy succeeded.
> +  @retval FALSE  SM3 context copy failed.
> +  @retval FALSE  This interface is not supported.
> +
> +**/
> +BOOLEAN
> +EFIAPI
> +Sm3Duplicate (
> +  IN   CONST VOID  *Sm3Context,
> +  OUT  VOID        *NewSm3Context
> +  )
> +{
> +  ASSERT (FALSE);
> +  return FALSE;
> +}
> +
> +/**
> +  Digests the input data and updates SM3 context.
> +
> +  This function performs SM3 digest on a data buffer of the specified size.
> +  It can be called multiple times to compute the digest of long or discontinuous
> data streams.
> +  SM3 context should be already correctly initialized by Sm3Init(), and should
> not be finalized
> +  by Sm3Final(). Behavior with invalid context is undefined.
> +
> +  If Sm3Context is NULL, then return FALSE.
> +
> +  @param[in, out]  Sm3Context     Pointer to the SM3 context.
> +  @param[in]       Data           Pointer to the buffer containing the data to be
> hashed.
> +  @param[in]       DataSize       Size of Data buffer in bytes.
> +
> +  @retval TRUE   SM3 data digest succeeded.
> +  @retval FALSE  SM3 data digest failed.
> +
> +**/
> +BOOLEAN
> +EFIAPI
> +Sm3Update (
> +  IN OUT  VOID        *Sm3Context,
> +  IN      CONST VOID  *Data,
> +  IN      UINTN       DataSize
> +  )
> +{
> +  ASSERT (FALSE);
> +  return FALSE;
> +}
> +
> +/**
> +  Completes computation of the SM3 digest value.
> +
> +  This function completes SM3 hash computation and retrieves the digest value
> into
> +  the specified memory. After this function has been called, the SM3 context
> cannot
> +  be used again.
> +  SM3 context should be already correctly initialized by Sm3Init(), and should
> not be
> +  finalized by Sm3Final(). Behavior with invalid SM3 context is undefined.
> +
> +  If Sm3Context is NULL, then return FALSE.
> +  If HashValue is NULL, then return FALSE.
> +
> +  @param[in, out]  Sm3Context     Pointer to the SM3 context.
> +  @param[out]      HashValue      Pointer to a buffer that receives the SM3 digest
> +                                  value (32 bytes).
> +
> +  @retval TRUE   SM3 digest computation succeeded.
> +  @retval FALSE  SM3 digest computation failed.
> +
> +**/
> +BOOLEAN
> +EFIAPI
> +Sm3Final (
> +  IN OUT  VOID   *Sm3Context,
> +  OUT     UINT8  *HashValue
> +  )
> +{
> +  ASSERT (FALSE);
> +  return FALSE;
> +}
> +
> +/**
> +  Computes the SM3 message digest of a input data buffer.
> +
> +  This function performs the SM3 message digest of a given data buffer, and
> places
> +  the digest value into the specified memory.
> +
> +  If this interface is not supported, then return FALSE.
> +
> +  @param[in]   Data        Pointer to the buffer containing the data to be hashed.
> +  @param[in]   DataSize    Size of Data buffer in bytes.
> +  @param[out]  HashValue   Pointer to a buffer that receives the SM3 digest
> +                           value (32 bytes).
> +
> +  @retval TRUE   SM3 digest computation succeeded.
> +  @retval FALSE  SM3 digest computation failed.
> +  @retval FALSE  This interface is not supported.
> +
> +**/
> +BOOLEAN
> +EFIAPI
> +Sm3HashAll (
> +  IN   CONST VOID  *Data,
> +  IN   UINTN       DataSize,
> +  OUT  UINT8       *HashValue
> +  )
> +{
> +  ASSERT (FALSE);
> +  return FALSE;
> +}
> diff --git a/CryptoPkg/Library/BaseCryptLibNull/Hmac/CryptHmacMd5Null.c
> b/CryptoPkg/Library/BaseCryptLibNull/Hmac/CryptHmacMd5Null.c
> new file mode 100644
> index 0000000000..3aafed874b
> --- /dev/null
> +++ b/CryptoPkg/Library/BaseCryptLibNull/Hmac/CryptHmacMd5Null.c
> @@ -0,0 +1,159 @@
> +/** @file
> +  HMAC-MD5 Wrapper Implementation which does not provide real capabilities.
> +
> +Copyright (c) 2012 - 2018, Intel Corporation. All rights reserved.<BR>
> +SPDX-License-Identifier: BSD-2-Clause-Patent
> +
> +**/
> +
> +#include "InternalCryptLib.h"
> +
> +/**
> +  Retrieves the size, in bytes, of the context buffer required for HMAC-MD5
> operations.
> +  (NOTE: This API is deprecated.
> +         Use HmacMd5New() / HmacMd5Free() for HMAC-MD5 Context
> operations.)
> +
> +  Return zero to indicate this interface is not supported.
> +
> +  @retval  0   This interface is not supported.
> +
> +**/
> +UINTN
> +EFIAPI
> +HmacMd5GetContextSize (
> +  VOID
> +  )
> +{
> +  ASSERT (FALSE);
> +  return 0;
> +}
> +
> +/**
> +  Allocates and initializes one HMAC_CTX context for subsequent HMAC-MD5
> use.
> +
> +  Return NULL to indicate this interface is not supported.
> +
> +  @retval NULL  This interface is not supported.
> +
> +**/
> +VOID *
> +EFIAPI
> +HmacMd5New (
> +  VOID
> +  )
> +{
> +  ASSERT (FALSE);
> +  return NULL;
> +}
> +
> +/**
> +  Release the specified HMAC_CTX context.
> +
> +  This function will do nothing.
> +
> +  @param[in]  HmacMd5Ctx  Pointer to the HMAC_CTX context to be released.
> +
> +**/
> +VOID
> +EFIAPI
> +HmacMd5Free (
> +  IN  VOID  *HmacMd5Ctx
> +  )
> +{
> +  ASSERT (FALSE);
> +  return;
> +}
> +
> +/**
> +  Initializes user-supplied memory pointed by HmacMd5Context as HMAC-MD5
> context for
> +  subsequent use.
> +
> +  Return FALSE to indicate this interface is not supported.
> +
> +  @param[out]  HmacMd5Context  Pointer to HMAC-MD5 context being
> initialized.
> +  @param[in]   Key             Pointer to the user-supplied key.
> +  @param[in]   KeySize         Key size in bytes.
> +
> +  @retval FALSE  This interface is not supported.
> +
> +**/
> +BOOLEAN
> +EFIAPI
> +HmacMd5Init (
> +  OUT  VOID         *HmacMd5Context,
> +  IN   CONST UINT8  *Key,
> +  IN   UINTN        KeySize
> +  )
> +{
> +  ASSERT (FALSE);
> +  return FALSE;
> +}
> +
> +/**
> +  Makes a copy of an existing HMAC-MD5 context.
> +
> +  Return FALSE to indicate this interface is not supported.
> +
> +  @param[in]  HmacMd5Context     Pointer to HMAC-MD5 context being copied.
> +  @param[out] NewHmacMd5Context  Pointer to new HMAC-MD5 context.
> +
> +  @retval FALSE  This interface is not supported.
> +
> +**/
> +BOOLEAN
> +EFIAPI
> +HmacMd5Duplicate (
> +  IN   CONST VOID  *HmacMd5Context,
> +  OUT  VOID        *NewHmacMd5Context
> +  )
> +{
> +  ASSERT (FALSE);
> +  return FALSE;
> +}
> +
> +/**
> +  Digests the input data and updates HMAC-MD5 context.
> +
> +  Return FALSE to indicate this interface is not supported.
> +
> +  @param[in, out]  HmacMd5Context  Pointer to the HMAC-MD5 context.
> +  @param[in]       Data            Pointer to the buffer containing the data to be
> digested.
> +  @param[in]       DataSize        Size of Data buffer in bytes.
> +
> +  @retval FALSE  This interface is not supported.
> +
> +**/
> +BOOLEAN
> +EFIAPI
> +HmacMd5Update (
> +  IN OUT  VOID        *HmacMd5Context,
> +  IN      CONST VOID  *Data,
> +  IN      UINTN       DataSize
> +  )
> +{
> +  ASSERT (FALSE);
> +  return FALSE;
> +}
> +
> +/**
> +  Completes computation of the HMAC-MD5 digest value.
> +
> +  Return FALSE to indicate this interface is not supported.
> +
> +  @param[in, out]  HmacMd5Context  Pointer to the HMAC-MD5 context.
> +  @param[out]      HmacValue       Pointer to a buffer that receives the HMAC-
> MD5 digest
> +                                   value (16 bytes).
> +
> +  @retval FALSE  This interface is not supported.
> +
> +**/
> +BOOLEAN
> +EFIAPI
> +HmacMd5Final (
> +  IN OUT  VOID   *HmacMd5Context,
> +  OUT     UINT8  *HmacValue
> +  )
> +{
> +  ASSERT (FALSE);
> +  return FALSE;
> +}
> diff --git a/CryptoPkg/Library/BaseCryptLibNull/Hmac/CryptHmacSha1Null.c
> b/CryptoPkg/Library/BaseCryptLibNull/Hmac/CryptHmacSha1Null.c
> new file mode 100644
> index 0000000000..547aa484ea
> --- /dev/null
> +++ b/CryptoPkg/Library/BaseCryptLibNull/Hmac/CryptHmacSha1Null.c
> @@ -0,0 +1,159 @@
> +/** @file
> +  HMAC-SHA1 Wrapper Implementation which does not provide real capabilities.
> +
> +Copyright (c) 2012 - 2018, Intel Corporation. All rights reserved.<BR>
> +SPDX-License-Identifier: BSD-2-Clause-Patent
> +
> +**/
> +
> +#include "InternalCryptLib.h"
> +
> +/**
> +  Retrieves the size, in bytes, of the context buffer required for HMAC-SHA1
> operations.
> +  (NOTE: This API is deprecated.
> +         Use HmacSha1New() / HmacSha1Free() for HMAC-SHA1 Context
> operations.)
> +
> +  Return zero to indicate this interface is not supported.
> +
> +  @retval  0   This interface is not supported.
> +
> +**/
> +UINTN
> +EFIAPI
> +HmacSha1GetContextSize (
> +  VOID
> +  )
> +{
> +  ASSERT (FALSE);
> +  return 0;
> +}
> +
> +/**
> +  Allocates and initializes one HMAC_CTX context for subsequent HMAC-SHA1
> use.
> +
> +  Return NULL to indicate this interface is not supported.
> +
> +  @return  NULL  This interface is not supported..
> +
> +**/
> +VOID *
> +EFIAPI
> +HmacSha1New (
> +  VOID
> +  )
> +{
> +  ASSERT (FALSE);
> +  return NULL;
> +}
> +
> +/**
> +  Release the specified HMAC_CTX context.
> +
> +  This function will do nothing.
> +
> +  @param[in]  HmacSha1Ctx  Pointer to the HMAC_CTX context to be released.
> +
> +**/
> +VOID
> +EFIAPI
> +HmacSha1Free (
> +  IN  VOID  *HmacSha1Ctx
> +  )
> +{
> +  ASSERT (FALSE);
> +  return;
> +}
> +
> +/**
> +  Initializes user-supplied memory pointed by HmacSha1Context as HMAC-SHA1
> context for
> +  subsequent use.
> +
> +  Return FALSE to indicate this interface is not supported.
> +
> +  @param[out]  HmacSha1Context  Pointer to HMAC-SHA1 context being
> initialized.
> +  @param[in]   Key              Pointer to the user-supplied key.
> +  @param[in]   KeySize          Key size in bytes.
> +
> +  @retval FALSE  This interface is not supported.
> +
> +**/
> +BOOLEAN
> +EFIAPI
> +HmacSha1Init (
> +  OUT  VOID         *HmacSha1Context,
> +  IN   CONST UINT8  *Key,
> +  IN   UINTN        KeySize
> +  )
> +{
> +  ASSERT (FALSE);
> +  return FALSE;
> +}
> +
> +/**
> +  Makes a copy of an existing HMAC-SHA1 context.
> +
> +  Return FALSE to indicate this interface is not supported.
> +
> +  @param[in]  HmacSha1Context     Pointer to HMAC-SHA1 context being
> copied.
> +  @param[out] NewHmacSha1Context  Pointer to new HMAC-SHA1 context.
> +
> +  @retval FALSE  This interface is not supported.
> +
> +**/
> +BOOLEAN
> +EFIAPI
> +HmacSha1Duplicate (
> +  IN   CONST VOID  *HmacSha1Context,
> +  OUT  VOID        *NewHmacSha1Context
> +  )
> +{
> +  ASSERT (FALSE);
> +  return FALSE;
> +}
> +
> +/**
> +  Digests the input data and updates HMAC-SHA1 context.
> +
> +  Return FALSE to indicate this interface is not supported.
> +
> +  @param[in, out]  HmacSha1Context Pointer to the HMAC-SHA1 context.
> +  @param[in]       Data            Pointer to the buffer containing the data to be
> digested.
> +  @param[in]       DataSize        Size of Data buffer in bytes.
> +
> +  @retval FALSE  This interface is not supported.
> +
> +**/
> +BOOLEAN
> +EFIAPI
> +HmacSha1Update (
> +  IN OUT  VOID        *HmacSha1Context,
> +  IN      CONST VOID  *Data,
> +  IN      UINTN       DataSize
> +  )
> +{
> +  ASSERT (FALSE);
> +  return FALSE;
> +}
> +
> +/**
> +  Completes computation of the HMAC-SHA1 digest value.
> +
> +  Return FALSE to indicate this interface is not supported.
> +
> +  @param[in, out]  HmacSha1Context  Pointer to the HMAC-SHA1 context.
> +  @param[out]      HmacValue        Pointer to a buffer that receives the HMAC-
> SHA1 digest
> +                                    value (20 bytes).
> +
> +  @retval FALSE  This interface is not supported.
> +
> +**/
> +BOOLEAN
> +EFIAPI
> +HmacSha1Final (
> +  IN OUT  VOID   *HmacSha1Context,
> +  OUT     UINT8  *HmacValue
> +  )
> +{
> +  ASSERT (FALSE);
> +  return FALSE;
> +}
> diff --git a/CryptoPkg/Library/BaseCryptLibNull/Hmac/CryptHmacSha256Null.c
> b/CryptoPkg/Library/BaseCryptLibNull/Hmac/CryptHmacSha256Null.c
> new file mode 100644
> index 0000000000..f0a4420e27
> --- /dev/null
> +++ b/CryptoPkg/Library/BaseCryptLibNull/Hmac/CryptHmacSha256Null.c
> @@ -0,0 +1,159 @@
> +/** @file
> +  HMAC-SHA256 Wrapper Implementation which does not provide real
> capabilities.
> +
> +Copyright (c) 2016 - 2017, Intel Corporation. All rights reserved.<BR>
> +SPDX-License-Identifier: BSD-2-Clause-Patent
> +
> +**/
> +
> +#include "InternalCryptLib.h"
> +
> +/**
> +  Retrieves the size, in bytes, of the context buffer required for HMAC-SHA256
> operations.
> +  (NOTE: This API is deprecated.
> +         Use HmacSha256New() / HmacSha256Free() for HMAC-SHA256 Context
> operations.)
> +
> +  Return zero to indicate this interface is not supported.
> +
> +  @retval  0   This interface is not supported.
> +
> +**/
> +UINTN
> +EFIAPI
> +HmacSha256GetContextSize (
> +  VOID
> +  )
> +{
> +  ASSERT (FALSE);
> +  return 0;
> +}
> +
> +/**
> +  Allocates and initializes one HMAC_CTX context for subsequent HMAC-
> SHA256 use.
> +
> +  Return NULL to indicate this interface is not supported.
> +
> +  @return  NULL  This interface is not supported..
> +
> +**/
> +VOID *
> +EFIAPI
> +HmacSha256New (
> +  VOID
> +  )
> +{
> +  ASSERT (FALSE);
> +  return NULL;
> +}
> +
> +/**
> +  Release the specified HMAC_CTX context.
> +
> +  This function will do nothing.
> +
> +  @param[in]  HmacSha256Ctx  Pointer to the HMAC_CTX context to be
> released.
> +
> +**/
> +VOID
> +EFIAPI
> +HmacSha256Free (
> +  IN  VOID  *HmacSha256Ctx
> +  )
> +{
> +  ASSERT (FALSE);
> +  return;
> +}
> +
> +/**
> +  Initializes user-supplied memory pointed by HmacSha256Context as HMAC-
> SHA256 context for
> +  subsequent use.
> +
> +  Return FALSE to indicate this interface is not supported.
> +
> +  @param[out]  HmacSha256Context  Pointer to HMAC-SHA256 context being
> initialized.
> +  @param[in]   Key                Pointer to the user-supplied key.
> +  @param[in]   KeySize            Key size in bytes.
> +
> +  @retval FALSE  This interface is not supported.
> +
> +**/
> +BOOLEAN
> +EFIAPI
> +HmacSha256Init (
> +  OUT  VOID         *HmacSha256Context,
> +  IN   CONST UINT8  *Key,
> +  IN   UINTN        KeySize
> +  )
> +{
> +  ASSERT (FALSE);
> +  return FALSE;
> +}
> +
> +/**
> +  Makes a copy of an existing HMAC-SHA256 context.
> +
> +  Return FALSE to indicate this interface is not supported.
> +
> +  @param[in]  HmacSha256Context     Pointer to HMAC-SHA256 context being
> copied.
> +  @param[out] NewHmacSha256Context  Pointer to new HMAC-SHA256
> context.
> +
> +  @retval FALSE  This interface is not supported.
> +
> +**/
> +BOOLEAN
> +EFIAPI
> +HmacSha256Duplicate (
> +  IN   CONST VOID  *HmacSha256Context,
> +  OUT  VOID        *NewHmacSha256Context
> +  )
> +{
> +  ASSERT (FALSE);
> +  return FALSE;
> +}
> +
> +/**
> +  Digests the input data and updates HMAC-SHA256 context.
> +
> +  Return FALSE to indicate this interface is not supported.
> +
> +  @param[in, out]  HmacSha256Context Pointer to the HMAC-SHA256 context.
> +  @param[in]       Data              Pointer to the buffer containing the data to be
> digested.
> +  @param[in]       DataSize          Size of Data buffer in bytes.
> +
> +  @retval FALSE  This interface is not supported.
> +
> +**/
> +BOOLEAN
> +EFIAPI
> +HmacSha256Update (
> +  IN OUT  VOID        *HmacSha256Context,
> +  IN      CONST VOID  *Data,
> +  IN      UINTN       DataSize
> +  )
> +{
> +  ASSERT (FALSE);
> +  return FALSE;
> +}
> +
> +/**
> +  Completes computation of the HMAC-SHA256 digest value.
> +
> +  Return FALSE to indicate this interface is not supported.
> +
> +  @param[in, out]  HmacSha256Context  Pointer to the HMAC-SHA256 context.
> +  @param[out]      HmacValue          Pointer to a buffer that receives the HMAC-
> SHA256 digest
> +                                      value (32 bytes).
> +
> +  @retval FALSE  This interface is not supported.
> +
> +**/
> +BOOLEAN
> +EFIAPI
> +HmacSha256Final (
> +  IN OUT  VOID   *HmacSha256Context,
> +  OUT     UINT8  *HmacValue
> +  )
> +{
> +  ASSERT (FALSE);
> +  return FALSE;
> +}
> diff --git a/CryptoPkg/Library/BaseCryptLibNull/InternalCryptLib.h
> b/CryptoPkg/Library/BaseCryptLibNull/InternalCryptLib.h
> new file mode 100644
> index 0000000000..96958592e1
> --- /dev/null
> +++ b/CryptoPkg/Library/BaseCryptLibNull/InternalCryptLib.h
> @@ -0,0 +1,16 @@
> +/** @file
> +  Internal include file for BaseCryptLibNull.
> +
> +Copyright (c) 2010 - 2017, Intel Corporation. All rights reserved.<BR>
> +SPDX-License-Identifier: BSD-2-Clause-Patent
> +
> +**/
> +
> +#ifndef __INTERNAL_CRYPT_LIB_H__
> +#define __INTERNAL_CRYPT_LIB_H__
> +
> +#include <Base.h>
> +#include <Library/BaseCryptLib.h>
> +#include <Library/DebugLib.h>
> +
> +#endif
> diff --git a/CryptoPkg/Library/BaseCryptLibNull/Pem/CryptPemNull.c
> b/CryptoPkg/Library/BaseCryptLibNull/Pem/CryptPemNull.c
> new file mode 100644
> index 0000000000..4eeabd91ad
> --- /dev/null
> +++ b/CryptoPkg/Library/BaseCryptLibNull/Pem/CryptPemNull.c
> @@ -0,0 +1,38 @@
> +/** @file
> +  PEM (Privacy Enhanced Mail) Format Handler Wrapper Implementation which
> does
> +  not provide real capabilities.
> +
> +Copyright (c) 2012, Intel Corporation. All rights reserved.<BR>
> +SPDX-License-Identifier: BSD-2-Clause-Patent
> +
> +**/
> +
> +#include "InternalCryptLib.h"
> +
> +/**
> +  Retrieve the RSA Private Key from the password-protected PEM key data.
> +
> +  Return FALSE to indicate this interface is not supported.
> +
> +  @param[in]  PemData      Pointer to the PEM-encoded key data to be
> retrieved.
> +  @param[in]  PemSize      Size of the PEM key data in bytes.
> +  @param[in]  Password     NULL-terminated passphrase used for encrypted
> PEM key data.
> +  @param[out] RsaContext   Pointer to new-generated RSA context which
> contain the retrieved
> +                           RSA private key component. Use RsaFree() function to free the
> +                           resource.
> +
> +  @retval FALSE  This interface is not supported.
> +
> +**/
> +BOOLEAN
> +EFIAPI
> +RsaGetPrivateKeyFromPem (
> +  IN   CONST UINT8  *PemData,
> +  IN   UINTN        PemSize,
> +  IN   CONST CHAR8  *Password,
> +  OUT  VOID         **RsaContext
> +  )
> +{
> +  ASSERT (FALSE);
> +  return FALSE;
> +}
> diff --git a/CryptoPkg/Library/BaseCryptLibNull/Pk/CryptAuthenticodeNull.c
> b/CryptoPkg/Library/BaseCryptLibNull/Pk/CryptAuthenticodeNull.c
> new file mode 100644
> index 0000000000..62e8400c4c
> --- /dev/null
> +++ b/CryptoPkg/Library/BaseCryptLibNull/Pk/CryptAuthenticodeNull.c
> @@ -0,0 +1,45 @@
> +/** @file
> +  Authenticode Portable Executable Signature Verification which does not
> provide
> +  real capabilities.
> +
> +Copyright (c) 2012, Intel Corporation. All rights reserved.<BR>
> +SPDX-License-Identifier: BSD-2-Clause-Patent
> +
> +**/
> +
> +#include "InternalCryptLib.h"
> +
> +/**
> +  Verifies the validity of a PE/COFF Authenticode Signature as described in
> "Windows
> +  Authenticode Portable Executable Signature Format".
> +
> +  Return FALSE to indicate this interface is not supported.
> +
> +  @param[in]  AuthData     Pointer to the Authenticode Signature retrieved from
> signed
> +                           PE/COFF image to be verified.
> +  @param[in]  DataSize     Size of the Authenticode Signature in bytes.
> +  @param[in]  TrustedCert  Pointer to a trusted/root certificate encoded in DER,
> which
> +                           is used for certificate chain verification.
> +  @param[in]  CertSize     Size of the trusted certificate in bytes.
> +  @param[in]  ImageHash    Pointer to the original image file hash value. The
> procedure
> +                           for calculating the image hash value is described in Authenticode
> +                           specification.
> +  @param[in]  HashSize     Size of Image hash value in bytes.
> +
> +  @retval FALSE  This interface is not supported.
> +
> +**/
> +BOOLEAN
> +EFIAPI
> +AuthenticodeVerify (
> +  IN  CONST UINT8  *AuthData,
> +  IN  UINTN        DataSize,
> +  IN  CONST UINT8  *TrustedCert,
> +  IN  UINTN        CertSize,
> +  IN  CONST UINT8  *ImageHash,
> +  IN  UINTN        HashSize
> +  )
> +{
> +  ASSERT (FALSE);
> +  return FALSE;
> +}
> diff --git a/CryptoPkg/Library/BaseCryptLibNull/Pk/CryptDhNull.c
> b/CryptoPkg/Library/BaseCryptLibNull/Pk/CryptDhNull.c
> new file mode 100644
> index 0000000000..8987084122
> --- /dev/null
> +++ b/CryptoPkg/Library/BaseCryptLibNull/Pk/CryptDhNull.c
> @@ -0,0 +1,150 @@
> +/** @file
> +  Diffie-Hellman Wrapper Implementation which does not provide
> +  real capabilities.
> +
> +Copyright (c) 2012 - 2018, Intel Corporation. All rights reserved.<BR>
> +SPDX-License-Identifier: BSD-2-Clause-Patent
> +
> +**/
> +
> +#include "InternalCryptLib.h"
> +
> +/**
> +  Allocates and Initializes one Diffie-Hellman Context for subsequent use.
> +
> +  @return  Pointer to the Diffie-Hellman Context that has been initialized.
> +           If the interface is not supported, DhNew() returns NULL.
> +
> +**/
> +VOID *
> +EFIAPI
> +DhNew (
> +  VOID
> +  )
> +{
> +  ASSERT (FALSE);
> +  return NULL;
> +}
> +
> +/**
> +  Release the specified DH context.
> +
> +  If the interface is not supported, then ASSERT().
> +
> +  @param[in]  DhContext  Pointer to the DH context to be released.
> +
> +**/
> +VOID
> +EFIAPI
> +DhFree (
> +  IN  VOID  *DhContext
> +  )
> +{
> +  ASSERT (FALSE);
> +}
> +
> +/**
> +  Generates DH parameter.
> +
> +  Return FALSE to indicate this interface is not supported.
> +
> +  @param[in, out]  DhContext    Pointer to the DH context.
> +  @param[in]       Generator    Value of generator.
> +  @param[in]       PrimeLength  Length in bits of prime to be generated.
> +  @param[out]      Prime        Pointer to the buffer to receive the generated
> prime number.
> +
> +  @retval FALSE  This interface is not supported.
> +
> +**/
> +BOOLEAN
> +EFIAPI
> +DhGenerateParameter (
> +  IN OUT  VOID   *DhContext,
> +  IN      UINTN  Generator,
> +  IN      UINTN  PrimeLength,
> +  OUT     UINT8  *Prime
> +  )
> +{
> +  ASSERT (FALSE);
> +  return FALSE;
> +}
> +
> +/**
> +  Sets generator and prime parameters for DH.
> +
> +  Return FALSE to indicate this interface is not supported.
> +
> +  @param[in, out]  DhContext    Pointer to the DH context.
> +  @param[in]       Generator    Value of generator.
> +  @param[in]       PrimeLength  Length in bits of prime to be generated.
> +  @param[in]       Prime        Pointer to the prime number.
> +
> +  @retval FALSE  This interface is not supported.
> +
> +**/
> +BOOLEAN
> +EFIAPI
> +DhSetParameter (
> +  IN OUT  VOID         *DhContext,
> +  IN      UINTN        Generator,
> +  IN      UINTN        PrimeLength,
> +  IN      CONST UINT8  *Prime
> +  )
> +{
> +  ASSERT (FALSE);
> +  return FALSE;
> +}
> +
> +/**
> +  Generates DH public key.
> +
> +  Return FALSE to indicate this interface is not supported.
> +
> +  @param[in, out]  DhContext      Pointer to the DH context.
> +  @param[out]      PublicKey      Pointer to the buffer to receive generated public
> key.
> +  @param[in, out]  PublicKeySize  On input, the size of PublicKey buffer in bytes.
> +                                  On output, the size of data returned in PublicKey buffer in
> bytes.
> +
> +  @retval FALSE  This interface is not supported.
> +
> +**/
> +BOOLEAN
> +EFIAPI
> +DhGenerateKey (
> +  IN OUT  VOID   *DhContext,
> +  OUT     UINT8  *PublicKey,
> +  IN OUT  UINTN  *PublicKeySize
> +  )
> +{
> +  ASSERT (FALSE);
> +  return FALSE;
> +}
> +
> +/**
> +  Computes exchanged common key.
> +
> +  Return FALSE to indicate this interface is not supported.
> +
> +  @param[in, out]  DhContext          Pointer to the DH context.
> +  @param[in]       PeerPublicKey      Pointer to the peer's public key.
> +  @param[in]       PeerPublicKeySize  Size of peer's public key in bytes.
> +  @param[out]      Key                Pointer to the buffer to receive generated key.
> +  @param[in, out]  KeySize            On input, the size of Key buffer in bytes.
> +                                      On output, the size of data returned in Key buffer in bytes.
> +
> +  @retval FALSE  This interface is not supported.
> +
> +**/
> +BOOLEAN
> +EFIAPI
> +DhComputeKey (
> +  IN OUT  VOID         *DhContext,
> +  IN      CONST UINT8  *PeerPublicKey,
> +  IN      UINTN        PeerPublicKeySize,
> +  OUT     UINT8        *Key,
> +  IN OUT  UINTN        *KeySize
> +  )
> +{
> +  ASSERT (FALSE);
> +  return FALSE;
> +}
> diff --git a/CryptoPkg/Library/BaseCryptLibNull/Pk/CryptPkcs1OaepNull.c
> b/CryptoPkg/Library/BaseCryptLibNull/Pk/CryptPkcs1OaepNull.c
> new file mode 100644
> index 0000000000..6571fc4a2e
> --- /dev/null
> +++ b/CryptoPkg/Library/BaseCryptLibNull/Pk/CryptPkcs1OaepNull.c
> @@ -0,0 +1,51 @@
> +/** @file
> +  This file contains UEFI wrapper functions for RSA PKCS1v2 OAEP encryption
> routines.
> +
> +  SPDX-License-Identifier: BSD-2-Clause-Patent
> +
> +  Copyright (C) 2016 Microsoft Corporation. All Rights Reserved.
> +  Copyright (c) 2019, Intel Corporation. All rights reserved.<BR>
> +
> +**/
> +
> +#include "InternalCryptLib.h"
> +
> +/**
> +  Encrypts a blob using PKCS1v2 (RSAES-OAEP) schema. On success, will return
> the
> +  encrypted message in a newly allocated buffer.
> +
> +  Return FALSE to indicate this interface is not supported.
> +
> +  @param[in]  PublicKey           A pointer to the DER-encoded X509 certificate
> that
> +                                  will be used to encrypt the data.
> +  @param[in]  PublicKeySize       Size of the X509 cert buffer.
> +  @param[in]  InData              Data to be encrypted.
> +  @param[in]  InDataSize          Size of the data buffer.
> +  @param[in]  PrngSeed            [Optional] If provided, a pointer to a random
> seed buffer
> +                                  to be used when initializing the PRNG. NULL otherwise.
> +  @param[in]  PrngSeedSize        [Optional] If provided, size of the random seed
> buffer.
> +                                  0 otherwise.
> +  @param[out] EncryptedData       Pointer to an allocated buffer containing the
> encrypted
> +                                  message.
> +  @param[out] EncryptedDataSize   Size of the encrypted message buffer.
> +
> +  @retval FALSE                   This interface is not supported.
> +
> +**/
> +BOOLEAN
> +EFIAPI
> +Pkcs1v2Encrypt (
> +  IN   CONST UINT8  *PublicKey,
> +  IN   UINTN        PublicKeySize,
> +  IN   UINT8        *InData,
> +  IN   UINTN        InDataSize,
> +  IN   CONST UINT8  *PrngSeed,  OPTIONAL
> +  IN   UINTN        PrngSeedSize,  OPTIONAL
> +  OUT  UINT8        **EncryptedData,
> +  OUT  UINTN        *EncryptedDataSize
> +  )
> +{
> +  ASSERT (FALSE);
> +  return FALSE;
> +}
> +
> diff --git a/CryptoPkg/Library/BaseCryptLibNull/Pk/CryptPkcs5Pbkdf2Null.c
> b/CryptoPkg/Library/BaseCryptLibNull/Pk/CryptPkcs5Pbkdf2Null.c
> new file mode 100644
> index 0000000000..7332db3ba1
> --- /dev/null
> +++ b/CryptoPkg/Library/BaseCryptLibNull/Pk/CryptPkcs5Pbkdf2Null.c
> @@ -0,0 +1,48 @@
> +/** @file
> +  PBKDF2 Key Derivation Function Wrapper Implementation which does not
> provide real
> +  capabilities.
> +
> +Copyright (c) 2016, Intel Corporation. All rights reserved.<BR>
> +SPDX-License-Identifier: BSD-2-Clause-Patent
> +
> +**/
> +
> +#include "InternalCryptLib.h"
> +
> +/**
> +  Derives a key from a password using a salt and iteration count, based on
> PKCS#5 v2.0
> +  password based encryption key derivation function PBKDF2, as specified in
> RFC 2898.
> +
> +  Return FALSE to indicate this interface is not supported.
> +
> +  @param[in]  PasswordLength  Length of input password in bytes.
> +  @param[in]  Password        Pointer to the array for the password.
> +  @param[in]  SaltLength      Size of the Salt in bytes.
> +  @param[in]  Salt            Pointer to the Salt.
> +  @param[in]  IterationCount  Number of iterations to perform. Its value should
> be
> +                              greater than or equal to 1.
> +  @param[in]  DigestSize      Size of the message digest to be used (eg.
> SHA256_DIGEST_SIZE).
> +                              NOTE: DigestSize will be used to determine the hash algorithm.
> +                                    Only SHA1_DIGEST_SIZE or SHA256_DIGEST_SIZE is
> supported.
> +  @param[in]  KeyLength       Size of the derived key buffer in bytes.
> +  @param[out] OutKey          Pointer to the output derived key buffer.
> +
> +  @retval  FALSE  This interface is not supported.
> +
> +**/
> +BOOLEAN
> +EFIAPI
> +Pkcs5HashPassword (
> +  IN  UINTN        PasswordLength,
> +  IN  CONST CHAR8  *Password,
> +  IN  UINTN        SaltLength,
> +  IN  CONST UINT8  *Salt,
> +  IN  UINTN        IterationCount,
> +  IN  UINTN        DigestSize,
> +  IN  UINTN        KeyLength,
> +  OUT UINT8        *OutKey
> +  )
> +{
> +  ASSERT (FALSE);
> +  return FALSE;
> +}
> diff --git a/CryptoPkg/Library/BaseCryptLibNull/Pk/CryptPkcs7SignNull.c
> b/CryptoPkg/Library/BaseCryptLibNull/Pk/CryptPkcs7SignNull.c
> new file mode 100644
> index 0000000000..d7ff8ba947
> --- /dev/null
> +++ b/CryptoPkg/Library/BaseCryptLibNull/Pk/CryptPkcs7SignNull.c
> @@ -0,0 +1,54 @@
> +/** @file
> +  PKCS#7 SignedData Sign Wrapper Implementation which does not provide real
> +  capabilities.
> +
> +Copyright (c) 2012, Intel Corporation. All rights reserved.<BR>
> +SPDX-License-Identifier: BSD-2-Clause-Patent
> +
> +**/
> +
> +#include "InternalCryptLib.h"
> +
> +/**
> +  Creates a PKCS#7 signedData as described in "PKCS #7: Cryptographic
> Message
> +  Syntax Standard, version 1.5". This interface is only intended to be used for
> +  application to perform PKCS#7 functionality validation.
> +
> +  Return FALSE to indicate this interface is not supported.
> +
> +  @param[in]  PrivateKey       Pointer to the PEM-formatted private key data for
> +                               data signing.
> +  @param[in]  PrivateKeySize   Size of the PEM private key data in bytes.
> +  @param[in]  KeyPassword      NULL-terminated passphrase used for encrypted
> PEM
> +                               key data.
> +  @param[in]  InData           Pointer to the content to be signed.
> +  @param[in]  InDataSize       Size of InData in bytes.
> +  @param[in]  SignCert         Pointer to signer's DER-encoded certificate to sign
> with.
> +  @param[in]  OtherCerts       Pointer to an optional additional set of
> certificates to
> +                               include in the PKCS#7 signedData (e.g. any intermediate
> +                               CAs in the chain).
> +  @param[out] SignedData       Pointer to output PKCS#7 signedData. It's caller's
> +                               responsibility to free the buffer with FreePool().
> +  @param[out] SignedDataSize   Size of SignedData in bytes.
> +
> +  @retval FALSE  This interface is not supported.
> +
> +**/
> +BOOLEAN
> +EFIAPI
> +Pkcs7Sign (
> +  IN   CONST UINT8  *PrivateKey,
> +  IN   UINTN        PrivateKeySize,
> +  IN   CONST UINT8  *KeyPassword,
> +  IN   UINT8        *InData,
> +  IN   UINTN        InDataSize,
> +  IN   UINT8        *SignCert,
> +  IN   UINT8        *OtherCerts      OPTIONAL,
> +  OUT  UINT8        **SignedData,
> +  OUT  UINTN        *SignedDataSize
> +  )
> +{
> +  ASSERT (FALSE);
> +  return FALSE;
> +}
> +
> diff --git a/CryptoPkg/Library/BaseCryptLibNull/Pk/CryptPkcs7VerifyEkuNull.c
> b/CryptoPkg/Library/BaseCryptLibNull/Pk/CryptPkcs7VerifyEkuNull.c
> new file mode 100644
> index 0000000000..cbeea935c9
> --- /dev/null
> +++ b/CryptoPkg/Library/BaseCryptLibNull/Pk/CryptPkcs7VerifyEkuNull.c
> @@ -0,0 +1,156 @@
> +/** @file
> +  PKCS7 Verify Null implementation.
> +
> +  Copyright (C) Microsoft Corporation. All Rights Reserved.
> +  Copyright (c) 2019, Intel Corporation. All rights reserved.<BR>
> +
> +  SPDX-License-Identifier: BSD-2-Clause-Patent
> +
> +**/
> +
> +#include "InternalCryptLib.h"
> +
> +/**
> +  This function will return the leaf signer certificate in a chain.  This is
> +  required because certificate chains are not guaranteed to have the
> +  certificates in the order that they were issued.
> +
> +  A typical certificate chain looks like this:
> +
> +
> +                 ----------------------------
> +                |            Root            |
> +                 ----------------------------
> +                               ^
> +                               |
> +                 ----------------------------
> +                |          Policy CA         | <-- Typical Trust Anchor.
> +                 ----------------------------
> +                               ^
> +                               |
> +                 ----------------------------
> +                |         Issuing CA         |
> +                 ----------------------------
> +                               ^
> +                               |
> +                 -----------------------------
> +                /  End-Entity (leaf) signer  / <-- Bottom certificate.
> +                -----------------------------  EKU: "1.3.6.1.4.1.311.76.9.21.1"
> +                                                    (Firmware Signing)
> +
> +
> +  @param[in]   CertChain            Certificate chain.
> +
> +  @param[out]  SignerCert           Last certificate in the chain.  For PKCS7
> signatures,
> +                                    this will be the end-entity (leaf) signer cert.
> +
> +  @retval EFI_SUCCESS               The required EKUs were found in the signature.
> +  @retval EFI_INVALID_PARAMETER     A parameter was invalid.
> +  @retval EFI_NOT_FOUND             The number of signers found was not 1.
> +
> +**/
> +EFI_STATUS
> +GetSignerCertificate (
> +  IN CONST VOID *CertChain,
> +  OUT VOID       **SignerCert
> +  )
> +{
> +  ASSERT(FALSE);
> +  return EFI_NOT_READY;
> +
> +}
> +
> +
> +/**
> +  Determines if the specified EKU represented in ASN1 form is present
> +  in a given certificate.
> +
> +  @param[in]  Cert                  The certificate to check.
> +
> +  @param[in]  Asn1ToFind            The EKU to look for.
> +
> +  @retval EFI_SUCCESS               We successfully identified the signing type.
> +  @retval EFI_INVALID_PARAMETER     A parameter was invalid.
> +  @retval EFI_NOT_FOUND             One or more EKU's were not found in the
> signature.
> +
> +**/
> +EFI_STATUS
> +IsEkuInCertificate (
> +  IN CONST VOID  *Cert,
> +  IN VOID *Asn1ToFind
> +  )
> +{
> +  ASSERT(FALSE);
> +  return EFI_NOT_READY;
> +}
> +
> +
> +/**
> +  Determines if the specified EKUs are present in a signing certificate.
> +
> +  @param[in]  SignerCert            The certificate to check.
> +  @param[in]  RequiredEKUs          The EKUs to look for.
> +  @param[in]  RequiredEKUsSize      The number of EKUs
> +  @param[in]  RequireAllPresent     If TRUE, then all the specified EKUs
> +                                    must be present in the certificate.
> +
> +  @retval EFI_SUCCESS               We successfully identified the signing type.
> +  @retval EFI_INVALID_PARAMETER     A parameter was invalid.
> +  @retval EFI_NOT_FOUND             One or more EKU's were not found in the
> signature.
> +**/
> +EFI_STATUS
> +CheckEKUs(
> +  IN CONST VOID     *SignerCert,
> +  IN CONST CHAR8    *RequiredEKUs[],
> +  IN CONST UINT32   RequiredEKUsSize,
> +  IN BOOLEAN        RequireAllPresent
> +  )
> +{
> +  ASSERT(FALSE);
> +  return EFI_NOT_READY;
> +}
> +
> +/**
> +  This function receives a PKCS#7 formatted signature blob,
> +  looks for the EKU SEQUENCE blob, and if found then looks
> +  for all the required EKUs. This function was created so that
> +  the Surface team can cut down on the number of Certificate
> +  Authorities (CA's) by checking EKU's on leaf signers for
> +  a specific product. This prevents one product's certificate
> +  from signing another product's firmware or unlock blobs.
> +
> +  Note that this function does not validate the certificate chain.
> +  That needs to be done before using this function.
> +
> +  @param[in]  Pkcs7Signature       The PKCS#7 signed information content block.
> An array
> +                                   containing the content block with both the signature,
> +                                   the signer's certificate, and any necessary intermediate
> +                                   certificates.
> +  @param[in]  Pkcs7SignatureSize   Number of bytes in Pkcs7Signature.
> +  @param[in]  RequiredEKUs         Array of null-terminated strings listing OIDs of
> +                                   required EKUs that must be present in the signature.
> +  @param[in]  RequiredEKUsSize     Number of elements in the RequiredEKUs
> string array.
> +  @param[in]  RequireAllPresent    If this is TRUE, then all of the specified EKU's
> +                                   must be present in the leaf signer.  If it is
> +                                   FALSE, then we will succeed if we find any
> +                                   of the specified EKU's.
> +
> +  @retval EFI_SUCCESS              The required EKUs were found in the signature.
> +  @retval EFI_INVALID_PARAMETER    A parameter was invalid.
> +  @retval EFI_NOT_FOUND            One or more EKU's were not found in the
> signature.
> +
> +**/
> +EFI_STATUS
> +EFIAPI
> +VerifyEKUsInPkcs7Signature (
> +  IN CONST UINT8    *Pkcs7Signature,
> +  IN CONST UINT32   SignatureSize,
> +  IN CONST CHAR8    *RequiredEKUs[],
> +  IN CONST UINT32   RequiredEKUsSize,
> +  IN BOOLEAN        RequireAllPresent
> +  )
> +{
> +  ASSERT(FALSE);
> +  return EFI_NOT_READY;
> +}
> +
> diff --git a/CryptoPkg/Library/BaseCryptLibNull/Pk/CryptPkcs7VerifyNull.c
> b/CryptoPkg/Library/BaseCryptLibNull/Pk/CryptPkcs7VerifyNull.c
> new file mode 100644
> index 0000000000..0ddf16a61b
> --- /dev/null
> +++ b/CryptoPkg/Library/BaseCryptLibNull/Pk/CryptPkcs7VerifyNull.c
> @@ -0,0 +1,163 @@
> +/** @file
> +  PKCS#7 SignedData Verification Wrapper Implementation which does not
> provide
> +  real capabilities.
> +
> +Copyright (c) 2012 - 2018, Intel Corporation. All rights reserved.<BR>
> +SPDX-License-Identifier: BSD-2-Clause-Patent
> +
> +**/
> +
> +#include "InternalCryptLib.h"
> +
> +/**
> +  Get the signer's certificates from PKCS#7 signed data as described in "PKCS #7:
> +  Cryptographic Message Syntax Standard". The input signed data could be
> wrapped
> +  in a ContentInfo structure.
> +
> +  Return FALSE to indicate this interface is not supported.
> +
> +  @param[in]  P7Data       Pointer to the PKCS#7 message to verify.
> +  @param[in]  P7Length     Length of the PKCS#7 message in bytes.
> +  @param[out] CertStack    Pointer to Signer's certificates retrieved from
> P7Data.
> +                           It's caller's responsibility to free the buffer with
> +                           Pkcs7FreeSigners().
> +                           This data structure is EFI_CERT_STACK type.
> +  @param[out] StackLength  Length of signer's certificates in bytes.
> +  @param[out] TrustedCert  Pointer to a trusted certificate from Signer's
> certificates.
> +                           It's caller's responsibility to free the buffer with
> +                           Pkcs7FreeSigners().
> +  @param[out] CertLength   Length of the trusted certificate in bytes.
> +
> +  @retval FALSE  This interface is not supported.
> +
> +**/
> +BOOLEAN
> +EFIAPI
> +Pkcs7GetSigners (
> +  IN  CONST UINT8  *P7Data,
> +  IN  UINTN        P7Length,
> +  OUT UINT8        **CertStack,
> +  OUT UINTN        *StackLength,
> +  OUT UINT8        **TrustedCert,
> +  OUT UINTN        *CertLength
> +  )
> +{
> +  ASSERT (FALSE);
> +  return FALSE;
> +}
> +
> +/**
> +  Wrap function to use free() to free allocated memory for certificates.
> +
> +  If the interface is not supported, then ASSERT().
> +
> +  @param[in]  Certs        Pointer to the certificates to be freed.
> +
> +**/
> +VOID
> +EFIAPI
> +Pkcs7FreeSigners (
> +  IN  UINT8        *Certs
> +  )
> +{
> +  ASSERT (FALSE);
> +}
> +
> +/**
> +  Retrieves all embedded certificates from PKCS#7 signed data as described in
> "PKCS #7:
> +  Cryptographic Message Syntax Standard", and outputs two certificate lists
> chained and
> +  unchained to the signer's certificates.
> +  The input signed data could be wrapped in a ContentInfo structure.
> +
> +  @param[in]  P7Data            Pointer to the PKCS#7 message.
> +  @param[in]  P7Length          Length of the PKCS#7 message in bytes.
> +  @param[out] SignerChainCerts  Pointer to the certificates list chained to
> signer's
> +                                certificate. It's caller's responsibility to free the buffer
> +                                with Pkcs7FreeSigners().
> +                                This data structure is EFI_CERT_STACK type.
> +  @param[out] ChainLength       Length of the chained certificates list buffer in
> bytes.
> +  @param[out] UnchainCerts      Pointer to the unchained certificates lists. It's
> caller's
> +                                responsibility to free the buffer with Pkcs7FreeSigners().
> +                                This data structure is EFI_CERT_STACK type.
> +  @param[out] UnchainLength     Length of the unchained certificates list buffer
> in bytes.
> +
> +  @retval  TRUE         The operation is finished successfully.
> +  @retval  FALSE        Error occurs during the operation.
> +
> +**/
> +BOOLEAN
> +EFIAPI
> +Pkcs7GetCertificatesList (
> +  IN  CONST UINT8  *P7Data,
> +  IN  UINTN        P7Length,
> +  OUT UINT8        **SignerChainCerts,
> +  OUT UINTN        *ChainLength,
> +  OUT UINT8        **UnchainCerts,
> +  OUT UINTN        *UnchainLength
> +  )
> +{
> +  ASSERT (FALSE);
> +  return FALSE;
> +}
> +
> +/**
> +  Verifies the validity of a PKCS#7 signed data as described in "PKCS #7:
> +  Cryptographic Message Syntax Standard". The input signed data could be
> wrapped
> +  in a ContentInfo structure.
> +
> +  Return FALSE to indicate this interface is not supported.
> +
> +  @param[in]  P7Data       Pointer to the PKCS#7 message to verify.
> +  @param[in]  P7Length     Length of the PKCS#7 message in bytes.
> +  @param[in]  TrustedCert  Pointer to a trusted/root certificate encoded in DER,
> which
> +                           is used for certificate chain verification.
> +  @param[in]  CertLength   Length of the trusted certificate in bytes.
> +  @param[in]  InData       Pointer to the content to be verified.
> +  @param[in]  DataLength   Length of InData in bytes.
> +
> +  @retval FALSE  This interface is not supported.
> +
> +**/
> +BOOLEAN
> +EFIAPI
> +Pkcs7Verify (
> +  IN  CONST UINT8  *P7Data,
> +  IN  UINTN        P7Length,
> +  IN  CONST UINT8  *TrustedCert,
> +  IN  UINTN        CertLength,
> +  IN  CONST UINT8  *InData,
> +  IN  UINTN        DataLength
> +  )
> +{
> +  ASSERT (FALSE);
> +  return FALSE;
> +}
> +
> +/**
> +  Extracts the attached content from a PKCS#7 signed data if existed. The input
> signed
> +  data could be wrapped in a ContentInfo structure.
> +
> +  Return FALSE to indicate this interface is not supported.
> +
> +  @param[in]   P7Data       Pointer to the PKCS#7 signed data to process.
> +  @param[in]   P7Length     Length of the PKCS#7 signed data in bytes.
> +  @param[out]  Content      Pointer to the extracted content from the PKCS#7
> signedData.
> +                            It's caller's responsibility to free the buffer with FreePool().
> +  @param[out]  ContentSize  The size of the extracted content in bytes.
> +
> +  @retval     TRUE          The P7Data was correctly formatted for processing.
> +  @retval     FALSE         The P7Data was not correctly formatted for processing.
> +
> +**/
> +BOOLEAN
> +EFIAPI
> +Pkcs7GetAttachedContent (
> +  IN  CONST UINT8  *P7Data,
> +  IN  UINTN        P7Length,
> +  OUT VOID         **Content,
> +  OUT UINTN        *ContentSize
> +  )
> +{
> +  ASSERT (FALSE);
> +  return FALSE;
> +}
> diff --git a/CryptoPkg/Library/BaseCryptLibNull/Pk/CryptRsaBasicNull.c
> b/CryptoPkg/Library/BaseCryptLibNull/Pk/CryptRsaBasicNull.c
> new file mode 100644
> index 0000000000..fd352e32dd
> --- /dev/null
> +++ b/CryptoPkg/Library/BaseCryptLibNull/Pk/CryptRsaBasicNull.c
> @@ -0,0 +1,121 @@
> +/** @file
> +  RSA Asymmetric Cipher Wrapper Null Implementation.
> +
> +  This file implements following APIs which provide basic capabilities for RSA:
> +  1) RsaNew
> +  2) RsaFree
> +  3) RsaSetKey
> +  4) RsaPkcs1Verify
> +
> +Copyright (c) 2009 - 2018, Intel Corporation. All rights reserved.<BR>
> +SPDX-License-Identifier: BSD-2-Clause-Patent
> +
> +**/
> +
> +#include "InternalCryptLib.h"
> +
> +/**
> +  Allocates and initializes one RSA context for subsequent use.
> +
> +  @return  Pointer to the RSA context that has been initialized.
> +           If the allocations fails, RsaNew() returns NULL.
> +
> +**/
> +VOID *
> +EFIAPI
> +RsaNew (
> +  VOID
> +  )
> +{
> +  //
> +  // Allocates & Initializes RSA Context
> +  //
> +  ASSERT (FALSE);
> +  return NULL;
> +}
> +
> +/**
> +  Release the specified RSA context.
> +
> +  @param[in]  RsaContext  Pointer to the RSA context to be released.
> +
> +**/
> +VOID
> +EFIAPI
> +RsaFree (
> +  IN  VOID  *RsaContext
> +  )
> +{
> +  //
> +  // Free RSA Context
> +  //
> +  ASSERT (FALSE);
> +}
> +
> +/**
> +  Sets the tag-designated key component into the established RSA context.
> +
> +  This function sets the tag-designated RSA key component into the established
> +  RSA context from the user-specified non-negative integer (octet string format
> +  represented in RSA PKCS#1).
> +  If BigNumber is NULL, then the specified key component in RSA context is
> cleared.
> +
> +  If RsaContext is NULL, then return FALSE.
> +
> +  @param[in, out]  RsaContext  Pointer to RSA context being set.
> +  @param[in]       KeyTag      Tag of RSA key component being set.
> +  @param[in]       BigNumber   Pointer to octet integer buffer.
> +                               If NULL, then the specified key component in RSA
> +                               context is cleared.
> +  @param[in]       BnSize      Size of big number buffer in bytes.
> +                               If BigNumber is NULL, then it is ignored.
> +
> +  @retval  TRUE   RSA key component was set successfully.
> +  @retval  FALSE  Invalid RSA key component tag.
> +
> +**/
> +BOOLEAN
> +EFIAPI
> +RsaSetKey (
> +  IN OUT  VOID         *RsaContext,
> +  IN      RSA_KEY_TAG  KeyTag,
> +  IN      CONST UINT8  *BigNumber,
> +  IN      UINTN        BnSize
> +  )
> +{
> +  ASSERT (FALSE);
> +  return FALSE;
> +}
> +
> +/**
> +  Verifies the RSA-SSA signature with EMSA-PKCS1-v1_5 encoding scheme
> defined in
> +  RSA PKCS#1.
> +
> +  If RsaContext is NULL, then return FALSE.
> +  If MessageHash is NULL, then return FALSE.
> +  If Signature is NULL, then return FALSE.
> +  If HashSize is not equal to the size of MD5, SHA-1 or SHA-256 digest, then
> return FALSE.
> +
> +  @param[in]  RsaContext   Pointer to RSA context for signature verification.
> +  @param[in]  MessageHash  Pointer to octet message hash to be checked.
> +  @param[in]  HashSize     Size of the message hash in bytes.
> +  @param[in]  Signature    Pointer to RSA PKCS1-v1_5 signature to be verified.
> +  @param[in]  SigSize      Size of signature in bytes.
> +
> +  @retval  TRUE   Valid signature encoded in PKCS1-v1_5.
> +  @retval  FALSE  Invalid signature or invalid RSA context.
> +
> +**/
> +BOOLEAN
> +EFIAPI
> +RsaPkcs1Verify (
> +  IN  VOID         *RsaContext,
> +  IN  CONST UINT8  *MessageHash,
> +  IN  UINTN        HashSize,
> +  IN  CONST UINT8  *Signature,
> +  IN  UINTN        SigSize
> +  )
> +{
> +  ASSERT (FALSE);
> +  return FALSE;
> +}
> diff --git a/CryptoPkg/Library/BaseCryptLibNull/Pk/CryptRsaExtNull.c
> b/CryptoPkg/Library/BaseCryptLibNull/Pk/CryptRsaExtNull.c
> new file mode 100644
> index 0000000000..2e74494c52
> --- /dev/null
> +++ b/CryptoPkg/Library/BaseCryptLibNull/Pk/CryptRsaExtNull.c
> @@ -0,0 +1,119 @@
> +/** @file
> +  RSA Asymmetric Cipher Wrapper Null Implementation.
> +
> +  This file does not provide real capabilities for following APIs in RSA handling:
> +  1) RsaGetKey
> +  2) RsaGenerateKey
> +  3) RsaCheckKey
> +  4) RsaPkcs1Sign
> +
> +Copyright (c) 2009 - 2018, Intel Corporation. All rights reserved.<BR>
> +SPDX-License-Identifier: BSD-2-Clause-Patent
> +
> +**/
> +
> +#include "InternalCryptLib.h"
> +
> +/**
> +  Gets the tag-designated RSA key component from the established RSA context.
> +
> +  Return FALSE to indicate this interface is not supported.
> +
> +  @param[in, out]  RsaContext  Pointer to RSA context being set.
> +  @param[in]       KeyTag      Tag of RSA key component being set.
> +  @param[out]      BigNumber   Pointer to octet integer buffer.
> +  @param[in, out]  BnSize      On input, the size of big number buffer in bytes.
> +                               On output, the size of data returned in big number buffer in
> bytes.
> +
> +  @retval FALSE  This interface is not supported.
> +
> +**/
> +BOOLEAN
> +EFIAPI
> +RsaGetKey (
> +  IN OUT  VOID         *RsaContext,
> +  IN      RSA_KEY_TAG  KeyTag,
> +  OUT     UINT8        *BigNumber,
> +  IN OUT  UINTN        *BnSize
> +  )
> +{
> +  ASSERT (FALSE);
> +  return FALSE;
> +}
> +
> +/**
> +  Generates RSA key components.
> +
> +  Return FALSE to indicate this interface is not supported.
> +
> +  @param[in, out]  RsaContext           Pointer to RSA context being set.
> +  @param[in]       ModulusLength        Length of RSA modulus N in bits.
> +  @param[in]       PublicExponent       Pointer to RSA public exponent.
> +  @param[in]       PublicExponentSize   Size of RSA public exponent buffer in
> bytes.
> +
> +  @retval FALSE  This interface is not supported.
> +
> +**/
> +BOOLEAN
> +EFIAPI
> +RsaGenerateKey (
> +  IN OUT  VOID         *RsaContext,
> +  IN      UINTN        ModulusLength,
> +  IN      CONST UINT8  *PublicExponent,
> +  IN      UINTN        PublicExponentSize
> +  )
> +{
> +  ASSERT (FALSE);
> +  return FALSE;
> +}
> +
> +/**
> +  Validates key components of RSA context.
> +
> +  Return FALSE to indicate this interface is not supported.
> +
> +  @param[in]  RsaContext  Pointer to RSA context to check.
> +
> +  @retval FALSE  This interface is not supported.
> +
> +**/
> +BOOLEAN
> +EFIAPI
> +RsaCheckKey (
> +  IN  VOID  *RsaContext
> +  )
> +{
> +  ASSERT (FALSE);
> +  return FALSE;
> +}
> +
> +/**
> +  Carries out the RSA-SSA signature generation with EMSA-PKCS1-v1_5
> encoding scheme.
> +
> +  Return FALSE to indicate this interface is not supported.
> +
> +  @param[in]       RsaContext   Pointer to RSA context for signature generation.
> +  @param[in]       MessageHash  Pointer to octet message hash to be signed.
> +  @param[in]       HashSize     Size of the message hash in bytes.
> +  @param[out]      Signature    Pointer to buffer to receive RSA PKCS1-v1_5
> signature.
> +  @param[in, out]  SigSize      On input, the size of Signature buffer in bytes.
> +                                On output, the size of data returned in Signature buffer in
> bytes.
> +
> +  @retval FALSE  This interface is not supported.
> +
> +**/
> +BOOLEAN
> +EFIAPI
> +RsaPkcs1Sign (
> +  IN      VOID         *RsaContext,
> +  IN      CONST UINT8  *MessageHash,
> +  IN      UINTN        HashSize,
> +  OUT     UINT8        *Signature,
> +  IN OUT  UINTN        *SigSize
> +  )
> +{
> +  ASSERT (FALSE);
> +  return FALSE;
> +}
> +
> +
> diff --git a/CryptoPkg/Library/BaseCryptLibNull/Pk/CryptTsNull.c
> b/CryptoPkg/Library/BaseCryptLibNull/Pk/CryptTsNull.c
> new file mode 100644
> index 0000000000..907988814a
> --- /dev/null
> +++ b/CryptoPkg/Library/BaseCryptLibNull/Pk/CryptTsNull.c
> @@ -0,0 +1,42 @@
> +/** @file
> +  RFC3161 Timestamp Countersignature Verification Wrapper Implementation
> which does
> +  not provide real capabilities.
> +
> +Copyright (c) 2014, Intel Corporation. All rights reserved.<BR>
> +SPDX-License-Identifier: BSD-2-Clause-Patent
> +
> +**/
> +
> +#include "InternalCryptLib.h"
> +
> +/**
> +  Verifies the validity of a RFC3161 Timestamp CounterSignature embedded in
> PE/COFF Authenticode
> +  signature.
> +
> +  Return FALSE to indicate this interface is not supported.
> +
> +  @param[in]  AuthData     Pointer to the Authenticode Signature retrieved from
> signed
> +                           PE/COFF image to be verified.
> +  @param[in]  DataSize     Size of the Authenticode Signature in bytes.
> +  @param[in]  TsaCert      Pointer to a trusted/root TSA certificate encoded in
> DER, which
> +                           is used for TSA certificate chain verification.
> +  @param[in]  CertSize     Size of the trusted certificate in bytes.
> +  @param[out] SigningTime  Return the time of timestamp generation time if
> the timestamp
> +                           signature is valid.
> +
> +  @retval  FALSE  This interface is not supported.
> +
> +**/
> +BOOLEAN
> +EFIAPI
> +ImageTimestampVerify (
> +  IN  CONST UINT8  *AuthData,
> +  IN  UINTN        DataSize,
> +  IN  CONST UINT8  *TsaCert,
> +  IN  UINTN        CertSize,
> +  OUT EFI_TIME     *SigningTime
> +  )
> +{
> +  ASSERT (FALSE);
> +  return FALSE;
> +}
> diff --git a/CryptoPkg/Library/BaseCryptLibNull/Pk/CryptX509Null.c
> b/CryptoPkg/Library/BaseCryptLibNull/Pk/CryptX509Null.c
> new file mode 100644
> index 0000000000..5e59cb1634
> --- /dev/null
> +++ b/CryptoPkg/Library/BaseCryptLibNull/Pk/CryptX509Null.c
> @@ -0,0 +1,264 @@
> +/** @file
> +  X.509 Certificate Handler Wrapper Implementation which does not provide
> +  real capabilities.
> +
> +Copyright (c) 2012 - 2018, Intel Corporation. All rights reserved.<BR>
> +SPDX-License-Identifier: BSD-2-Clause-Patent
> +
> +**/
> +
> +#include "InternalCryptLib.h"
> +
> +/**
> +  Construct a X509 object from DER-encoded certificate data.
> +
> +  Return FALSE to indicate this interface is not supported.
> +
> +  @param[in]  Cert            Pointer to the DER-encoded certificate data.
> +  @param[in]  CertSize        The size of certificate data in bytes.
> +  @param[out] SingleX509Cert  The generated X509 object.
> +
> +  @retval FALSE  This interface is not supported.
> +
> +**/
> +BOOLEAN
> +EFIAPI
> +X509ConstructCertificate (
> +  IN   CONST UINT8  *Cert,
> +  IN   UINTN        CertSize,
> +  OUT  UINT8        **SingleX509Cert
> +  )
> +{
> +  ASSERT (FALSE);
> +  return FALSE;
> +}
> +
> +/**
> +  Construct a X509 stack object from a list of DER-encoded certificate data.
> +
> +  Return FALSE to indicate this interface is not supported.
> +
> +  @param[in, out]  X509Stack  On input, pointer to an existing or NULL X509
> stack object.
> +                              On output, pointer to the X509 stack object with new
> +                              inserted X509 certificate.
> +  @param           ...        A list of DER-encoded single certificate data followed
> +                              by certificate size. A NULL terminates the list. The
> +                              pairs are the arguments to X509ConstructCertificate().
> +
> +  @retval FALSE  This interface is not supported.
> +
> +**/
> +BOOLEAN
> +EFIAPI
> +X509ConstructCertificateStack (
> +  IN OUT  UINT8  **X509Stack,
> +  ...
> +  )
> +{
> +  ASSERT (FALSE);
> +  return FALSE;
> +}
> +
> +/**
> +  Release the specified X509 object.
> +
> +  If the interface is not supported, then ASSERT().
> +
> +  @param[in]  X509Cert  Pointer to the X509 object to be released.
> +
> +**/
> +VOID
> +EFIAPI
> +X509Free (
> +  IN  VOID  *X509Cert
> +  )
> +{
> +  ASSERT (FALSE);
> +}
> +
> +/**
> +  Release the specified X509 stack object.
> +
> +  If the interface is not supported, then ASSERT().
> +
> +  @param[in]  X509Stack  Pointer to the X509 stack object to be released.
> +
> +**/
> +VOID
> +EFIAPI
> +X509StackFree (
> +  IN  VOID  *X509Stack
> +  )
> +{
> +  ASSERT (FALSE);
> +}
> +
> +/**
> +  Retrieve the subject bytes from one X.509 certificate.
> +
> +  Return FALSE to indicate this interface is not supported.
> +
> +  @param[in]      Cert         Pointer to the DER-encoded X509 certificate.
> +  @param[in]      CertSize     Size of the X509 certificate in bytes.
> +  @param[out]     CertSubject  Pointer to the retrieved certificate subject bytes.
> +  @param[in, out] SubjectSize  The size in bytes of the CertSubject buffer on
> input,
> +                               and the size of buffer returned CertSubject on output.
> +
> +
> +  @retval FALSE  This interface is not supported.
> +
> +**/
> +BOOLEAN
> +EFIAPI
> +X509GetSubjectName (
> +  IN      CONST UINT8  *Cert,
> +  IN      UINTN        CertSize,
> +  OUT     UINT8        *CertSubject,
> +  IN OUT  UINTN        *SubjectSize
> +  )
> +{
> +  ASSERT (FALSE);
> +  return FALSE;
> +}
> +
> +/**
> +  Retrieve the common name (CN) string from one X.509 certificate.
> +
> +  Return RETURN_UNSUPPORTED to indicate this interface is not supported.
> +
> +  @param[in]      Cert             Pointer to the DER-encoded X509 certificate.
> +  @param[in]      CertSize         Size of the X509 certificate in bytes.
> +  @param[out]     CommonName       Buffer to contain the retrieved certificate
> common
> +                                   name string (UTF8). At most CommonNameSize bytes will
> be
> +                                   written and the string will be null terminated. May be
> +                                   NULL in order to determine the size buffer needed.
> +  @param[in,out]  CommonNameSize   The size in bytes of the CommonName
> buffer on input,
> +                                   and the size of buffer returned CommonName on output.
> +                                   If CommonName is NULL then the amount of space needed
> +                                   in buffer (including the final null) is returned.
> +
> +  @retval RETURN_UNSUPPORTED       The operation is not supported.
> +
> +**/
> +RETURN_STATUS
> +EFIAPI
> +X509GetCommonName (
> +  IN      CONST UINT8  *Cert,
> +  IN      UINTN        CertSize,
> +  OUT     CHAR8        *CommonName,  OPTIONAL
> +  IN OUT  UINTN        *CommonNameSize
> +  )
> +{
> +  ASSERT (FALSE);
> +  return RETURN_UNSUPPORTED;
> +}
> +
> +/**
> +  Retrieve the organization name (ON) string from one X.509 certificate.
> +
> +  Return RETURN_UNSUPPORTED to indicate this interface is not supported.
> +
> +  @param[in]      Cert             Pointer to the DER-encoded X509 certificate.
> +  @param[in]      CertSize         Size of the X509 certificate in bytes.
> +  @param[out]     NameBuffer       Buffer to contain the retrieved certificate
> organization
> +                                   name string. At most NameBufferSize bytes will be
> +                                   written and the string will be null terminated. May be
> +                                   NULL in order to determine the size buffer needed.
> +  @param[in,out]  NameBufferSize   The size in bytes of the Name buffer on
> input,
> +                                   and the size of buffer returned Name on output.
> +                                   If NameBuffer is NULL then the amount of space needed
> +                                   in buffer (including the final null) is returned.
> +
> +  @retval RETURN_UNSUPPORTED       The operation is not supported.
> +
> +**/
> +RETURN_STATUS
> +EFIAPI
> +X509GetOrganizationName (
> +  IN      CONST UINT8   *Cert,
> +  IN      UINTN         CertSize,
> +  OUT     CHAR8         *NameBuffer,  OPTIONAL
> +  IN OUT  UINTN         *NameBufferSize
> +  )
> +{
> +  ASSERT (FALSE);
> +  return RETURN_UNSUPPORTED;
> +}
> +
> +/**
> +  Retrieve the RSA Public Key from one DER-encoded X509 certificate.
> +
> +  Return FALSE to indicate this interface is not supported.
> +
> +  @param[in]  Cert         Pointer to the DER-encoded X509 certificate.
> +  @param[in]  CertSize     Size of the X509 certificate in bytes.
> +  @param[out] RsaContext   Pointer to new-generated RSA context which
> contain the retrieved
> +                           RSA public key component. Use RsaFree() function to free the
> +                           resource.
> +
> +  @retval FALSE  This interface is not supported.
> +
> +**/
> +BOOLEAN
> +EFIAPI
> +RsaGetPublicKeyFromX509 (
> +  IN   CONST UINT8  *Cert,
> +  IN   UINTN        CertSize,
> +  OUT  VOID         **RsaContext
> +  )
> +{
> +  ASSERT (FALSE);
> +  return FALSE;
> +}
> +
> +/**
> +  Verify one X509 certificate was issued by the trusted CA.
> +
> +  Return FALSE to indicate this interface is not supported.
> +
> +  @param[in]      Cert         Pointer to the DER-encoded X509 certificate to be
> verified.
> +  @param[in]      CertSize     Size of the X509 certificate in bytes.
> +  @param[in]      CACert       Pointer to the DER-encoded trusted CA certificate.
> +  @param[in]      CACertSize   Size of the CA Certificate in bytes.
> +
> +  @retval FALSE  This interface is not supported.
> +
> +**/
> +BOOLEAN
> +EFIAPI
> +X509VerifyCert (
> +  IN  CONST UINT8  *Cert,
> +  IN  UINTN        CertSize,
> +  IN  CONST UINT8  *CACert,
> +  IN  UINTN        CACertSize
> +  )
> +{
> +  ASSERT (FALSE);
> +  return FALSE;
> +}
> +
> +/**
> +  Retrieve the TBSCertificate from one given X.509 certificate.
> +
> +  Return FALSE to indicate this interface is not supported.
> +
> +  @param[in]      Cert         Pointer to the given DER-encoded X509 certificate.
> +  @param[in]      CertSize     Size of the X509 certificate in bytes.
> +  @param[out]     TBSCert      DER-Encoded To-Be-Signed certificate.
> +  @param[out]     TBSCertSize  Size of the TBS certificate in bytes.
> +
> +  @retval  FALSE  This interface is not supported.
> +
> +**/
> +BOOLEAN
> +EFIAPI
> +X509GetTBSCert (
> +  IN  CONST UINT8  *Cert,
> +  IN  UINTN        CertSize,
> +  OUT UINT8        **TBSCert,
> +  OUT UINTN        *TBSCertSize
> +  )
> +{
> +  ASSERT (FALSE);
> +  return FALSE;
> +}
> diff --git a/CryptoPkg/Library/BaseCryptLibNull/Rand/CryptRandNull.c
> b/CryptoPkg/Library/BaseCryptLibNull/Rand/CryptRandNull.c
> new file mode 100644
> index 0000000000..d2914f8758
> --- /dev/null
> +++ b/CryptoPkg/Library/BaseCryptLibNull/Rand/CryptRandNull.c
> @@ -0,0 +1,57 @@
> +/** @file
> +  Pseudorandom Number Generator Wrapper Implementation which does not
> provide
> +  real capabilities.
> +
> +Copyright (c) 2012, Intel Corporation. All rights reserved.<BR>
> +SPDX-License-Identifier: BSD-2-Clause-Patent
> +
> +**/
> +
> +#include "InternalCryptLib.h"
> +
> +
> +/**
> +  Sets up the seed value for the pseudorandom number generator.
> +
> +  Return FALSE to indicate this interface is not supported.
> +
> +  @param[in]  Seed      Pointer to seed value.
> +                        If NULL, default seed is used.
> +  @param[in]  SeedSize  Size of seed value.
> +                        If Seed is NULL, this parameter is ignored.
> +
> +  @retval FALSE  This interface is not supported.
> +
> +**/
> +BOOLEAN
> +EFIAPI
> +RandomSeed (
> +  IN  CONST  UINT8  *Seed  OPTIONAL,
> +  IN  UINTN         SeedSize
> +  )
> +{
> +  ASSERT (FALSE);
> +  return FALSE;
> +}
> +
> +/**
> +  Generates a pseudorandom byte stream of the specified size.
> +
> +  Return FALSE to indicate this interface is not supported.
> +
> +  @param[out]  Output  Pointer to buffer to receive random value.
> +  @param[in]   Size    Size of random bytes to generate.
> +
> +  @retval FALSE  This interface is not supported.
> +
> +**/
> +BOOLEAN
> +EFIAPI
> +RandomBytes (
> +  OUT  UINT8  *Output,
> +  IN   UINTN  Size
> +  )
> +{
> +  ASSERT (FALSE);
> +  return FALSE;
> +}
> --
> 2.21.0.windows.1


-=-=-=-=-=-=-=-=-=-=-=-
Groups.io Links: You receive all messages sent to this group.

View/Reply Online (#49408): https://edk2.groups.io/g/devel/message/49408
Mute This Topic: https://groups.io/mt/36469339/1787277
Group Owner: devel+owner@edk2.groups.io
Unsubscribe: https://edk2.groups.io/g/devel/unsub  [importer@patchew.org]
-=-=-=-=-=-=-=-=-=-=-=-