From: Matthew Carlson <macarl@microsoft.com>
This version of RngLib makes use of EFI_RNG_PROTOCOL to provide random
number. According to UEFI spec, EFI_RNG_PROTOCOL should meet NIST SP
800-90 and/or ANSI X9.31 standards.
Ref: https://bugzilla.tianocore.org/show_bug.cgi?id=1871
Cc: Jiewen Yao <jiewen.yao@intel.com>
Cc: Chao Zhang <chao.b.zhang@intel.com>
Cc: Laszlo Ersek <lersek@redhat.com>
Cc: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Cc: Matthew Carlson <macarl@microsoft.com>
Cc: Sean Brogan <sean.brogan@microsoft.com>
Cc: Bret Barkelew <bret.barkelew@microsoft.com>
Cc: Liming Gao <liming.gao@intel.com>
Cc: Ray Ni <ray.ni@intel.com>
Signed-off-by: Jian J Wang <jian.j.wang@intel.com>
---
.../DxeRngLibRngProtocol.c | 200 ++++++++++++++++++
.../DxeRngLibRngProtocol.inf | 42 ++++
.../DxeRngLibRngProtocol.uni | 14 ++
3 files changed, 256 insertions(+)
create mode 100644 SecurityPkg/RandomNumberGenerator/DxeRngLibRngProtocol/DxeRngLibRngProtocol.c
create mode 100644 SecurityPkg/RandomNumberGenerator/DxeRngLibRngProtocol/DxeRngLibRngProtocol.inf
create mode 100644 SecurityPkg/RandomNumberGenerator/DxeRngLibRngProtocol/DxeRngLibRngProtocol.uni
diff --git a/SecurityPkg/RandomNumberGenerator/DxeRngLibRngProtocol/DxeRngLibRngProtocol.c b/SecurityPkg/RandomNumberGenerator/DxeRngLibRngProtocol/DxeRngLibRngProtocol.c
new file mode 100644
index 0000000000..8ce4a7050d
--- /dev/null
+++ b/SecurityPkg/RandomNumberGenerator/DxeRngLibRngProtocol/DxeRngLibRngProtocol.c
@@ -0,0 +1,200 @@
+/** @file
+ Provides an implementation of the library class RngLib that uses the Rng protocol.
+
+Copyright (c) Microsoft Corporation. All rights reserved.
+Copyright (c) 2019, Intel Corporation. All rights reserved.
+SPDX-License-Identifier: BSD-2-Clause-Patent
+
+**/
+#include <Uefi.h>
+#include <Library/UefiBootServicesTableLib.h>
+#include <Library/DebugLib.h>
+#include <Library/RngLib.h>
+#include <Protocol/Rng.h>
+
+/**
+ Generates a random number via the NIST 800-9A algorithm. Refer to
+ http://csrc.nist.gov/groups/STM/cavp/documents/drbg/DRBGVS.pdf
+ for more information.
+
+ @param[out] Buffer Buffer to receive the random number.
+ @param[in] BufferSize Number of bytes in Buffer.
+
+ @retval EFI_SUCCESS Random data generated successfully.
+ @retval Others Failed to generate the random number.
+
+**/
+STATIC
+EFI_STATUS
+GenerateRandomNumberViaNist800Algorithm(
+ OUT UINT8* Buffer,
+ IN UINTN BufferSize
+ )
+{
+ EFI_STATUS Status;
+ EFI_RNG_PROTOCOL* RngProtocol;
+
+ Status = EFI_UNSUPPORTED;
+ RngProtocol = NULL;
+
+ if (Buffer == NULL) {
+ DEBUG ((DEBUG_ERROR, "[%a] Buffer == NULL.\n", __FUNCTION__));
+ return EFI_INVALID_PARAMETER;
+ }
+
+ if (gBS == NULL) {
+ DEBUG ((DEBUG_ERROR, "[%a] GenerateRandomNumber, gBS == NULL. Called too soon.\n", __FUNCTION__));
+ return EFI_LOAD_ERROR;
+ }
+
+ Status = gBS->LocateProtocol (&gEfiRngProtocolGuid, NULL, (VOID **)&RngProtocol);
+ if (EFI_ERROR (Status) || RngProtocol == NULL) {
+ DEBUG ((DEBUG_ERROR, "[%a] Could not locate RNG prototocol, Status = %r\n", __FUNCTION__, Status));
+ return Status;
+ }
+
+ Status = RngProtocol->GetRNG (RngProtocol, &gEfiRngAlgorithmSp80090Ctr256Guid, BufferSize, Buffer);
+ DEBUG ((DEBUG_VERBOSE, "[%a] GetRNG algorithm CTR-256 - Status = %r\n", __FUNCTION__, Status));
+ if (!EFI_ERROR (Status)) {
+ return Status;
+ }
+
+ Status = RngProtocol->GetRNG (RngProtocol, &gEfiRngAlgorithmSp80090Hmac256Guid, BufferSize, Buffer);
+ DEBUG ((DEBUG_VERBOSE, "[%a] GetRNG algorithm HMAC-256 - Status = %r\n", __FUNCTION__, Status));
+ if (!EFI_ERROR (Status)) {
+ return Status;
+ }
+
+ Status = RngProtocol->GetRNG (RngProtocol, &gEfiRngAlgorithmSp80090Hash256Guid, BufferSize, Buffer);
+ DEBUG ((DEBUG_VERBOSE, "[%a] GetRNG algorithm Hash-256 - Status = %r\n", __FUNCTION__, Status));
+ if (!EFI_ERROR (Status)) {
+ return Status;
+ }
+ //
+ // If we get to this point, we have failed
+ //
+ DEBUG((DEBUG_ERROR, "[%a] GetRNG() failed, staus = %r\n", __FUNCTION__, Status));
+
+ return Status;
+}
+
+
+/**
+ Generates a 16-bit random number.
+
+ if Rand is NULL, return FALSE.
+
+ @param[out] Rand Buffer pointer to store the 16-bit random value.
+
+ @retval TRUE Random number generated successfully.
+ @retval FALSE Failed to generate the random number.
+
+**/
+BOOLEAN
+EFIAPI
+GetRandomNumber16 (
+ OUT UINT16 *Rand
+ )
+{
+ EFI_STATUS Status;
+
+ if (Rand == NULL) {
+ return FALSE;
+ }
+
+ Status = GenerateRandomNumberViaNist800Algorithm ((UINT8 *)Rand, 2);
+ if (EFI_ERROR (Status)) {
+ return FALSE;
+ }
+ return TRUE;
+}
+
+/**
+ Generates a 32-bit random number.
+
+ if Rand is NULL, return FALSE.
+
+ @param[out] Rand Buffer pointer to store the 32-bit random value.
+
+ @retval TRUE Random number generated successfully.
+ @retval FALSE Failed to generate the random number.
+
+**/
+BOOLEAN
+EFIAPI
+GetRandomNumber32 (
+ OUT UINT32 *Rand
+ )
+{
+ EFI_STATUS Status;
+
+ if (Rand == NULL) {
+ return FALSE;
+ }
+
+ Status = GenerateRandomNumberViaNist800Algorithm ((UINT8 *)Rand, 4);
+ if (EFI_ERROR (Status)) {
+ return FALSE;
+ }
+ return TRUE;
+}
+
+/**
+ Generates a 64-bit random number.
+
+ if Rand is NULL, return FALSE.
+
+ @param[out] Rand Buffer pointer to store the 64-bit random value.
+
+ @retval TRUE Random number generated successfully.
+ @retval FALSE Failed to generate the random number.
+
+**/
+BOOLEAN
+EFIAPI
+GetRandomNumber64 (
+ OUT UINT64 *Rand
+ )
+{
+ EFI_STATUS Status;
+
+ if (Rand == NULL) {
+ return FALSE;
+ }
+
+ Status = GenerateRandomNumberViaNist800Algorithm ((UINT8 *)Rand, 8);
+ if (EFI_ERROR (Status)) {
+ return FALSE;
+ }
+ return TRUE;
+}
+
+/**
+ Generates a 128-bit random number.
+
+ if Rand is NULL, return FALSE.
+
+ @param[out] Rand Buffer pointer to store the 128-bit random value.
+
+ @retval TRUE Random number generated successfully.
+ @retval FALSE Failed to generate the random number.
+
+**/
+BOOLEAN
+EFIAPI
+GetRandomNumber128 (
+ OUT UINT64 *Rand
+ )
+{
+ EFI_STATUS Status;
+
+ if (Rand == NULL) {
+ return FALSE;
+ }
+
+ Status = GenerateRandomNumberViaNist800Algorithm ((UINT8 *)Rand, 16);
+ if (EFI_ERROR (Status)) {
+ return FALSE;
+ }
+ return TRUE;
+}
diff --git a/SecurityPkg/RandomNumberGenerator/DxeRngLibRngProtocol/DxeRngLibRngProtocol.inf b/SecurityPkg/RandomNumberGenerator/DxeRngLibRngProtocol/DxeRngLibRngProtocol.inf
new file mode 100644
index 0000000000..d47fe3be53
--- /dev/null
+++ b/SecurityPkg/RandomNumberGenerator/DxeRngLibRngProtocol/DxeRngLibRngProtocol.inf
@@ -0,0 +1,42 @@
+# @file
+# Provides implementation of the library class RngLib that uses the RngProtocol
+#
+# @copyright
+# Copyright (c) Microsoft Corporation. All rights reserved.
+# SPDX-License-Identifier: BSD-2-Clause-Patent
+#
+##
+
+[Defines]
+ INF_VERSION = 0x00010029
+ BASE_NAME = DxeRngLibRngProtocol
+ MODULE_UNI_FILE = DxeRngLibRngProtocol.uni
+ FILE_GUID = FF9F84C5-A33E-44E3-9BB5-0D654B2D4149
+ MODULE_TYPE = DXE_DRIVER
+ VERSION_STRING = 1.0
+ LIBRARY_CLASS = RngLib|DXE_DRIVER DXE_RUNTIME_DRIVER DXE_SMM_DRIVER UEFI_APPLICATION UEFI_DRIVER
+
+#
+# VALID_ARCHITECTURES = IA32 X64 EBC ARM AARCH64
+#
+
+[Packages]
+ MdePkg/MdePkg.dec
+
+[Sources]
+ DxeRngLibRngProtocol.c
+
+[LibraryClasses]
+ DebugLib
+ UefiBootServicesTableLib
+
+[Protocols]
+ gEfiRngProtocolGuid ## CONSUMES
+
+[Depex]
+ gEfiRngProtocolGuid
+
+[Guids]
+ gEfiRngAlgorithmSp80090Ctr256Guid ## CONSUMES
+ gEfiRngAlgorithmSp80090Hash256Guid ## CONSUMES
+ gEfiRngAlgorithmSp80090Hmac256Guid ## CONSUMES
diff --git a/SecurityPkg/RandomNumberGenerator/DxeRngLibRngProtocol/DxeRngLibRngProtocol.uni b/SecurityPkg/RandomNumberGenerator/DxeRngLibRngProtocol/DxeRngLibRngProtocol.uni
new file mode 100644
index 0000000000..09af056bd3
--- /dev/null
+++ b/SecurityPkg/RandomNumberGenerator/DxeRngLibRngProtocol/DxeRngLibRngProtocol.uni
@@ -0,0 +1,14 @@
+// /** @file
+// Instance of RNG (Random Number Generator) Library Based on EFI_RNG_PROTOCOL.
+//
+// Copyright (c) 2019, Intel Corporation. All rights reserved.<BR>
+//
+// SPDX-License-Identifier: BSD-2-Clause-Patent
+//
+// **/
+
+
+#string STR_MODULE_ABSTRACT #language en-US "Instance of RNG Library Based on EFI_RNG_PROTOCOL."
+
+#string STR_MODULE_DESCRIPTION #language en-US "This version of RNG library makes use of EFI_RNG_PROTOCOL to generate random number compliant with NIST 800-9A."
+
--
2.17.1.windows.2
-=-=-=-=-=-=-=-=-=-=-=-
Groups.io Links: You receive all messages sent to this group.
View/Reply Online (#50612): https://edk2.groups.io/g/devel/message/50612
Mute This Topic: https://groups.io/mt/56714115/1787277
Group Owner: devel+owner@edk2.groups.io
Unsubscribe: https://edk2.groups.io/g/devel/unsub [importer@patchew.org]
-=-=-=-=-=-=-=-=-=-=-=-
On 11/14/19 03:17, Wang, Jian J wrote:
> From: Matthew Carlson <macarl@microsoft.com>
>
> This version of RngLib makes use of EFI_RNG_PROTOCOL to provide random
> number. According to UEFI spec, EFI_RNG_PROTOCOL should meet NIST SP
> 800-90 and/or ANSI X9.31 standards.
I'd like to slightly correct the UEFI spec reference. In UEFI-2.8,
section "37.5.1 EFI RNG Algorithm Definitions" writes,
[...] The algorithms listed are optional, not meant to be exhaustive
and may be augmented by vendors or other industry standards. [...]
Meaning that an EFI_RNG_PROTOCOL instance is not "required", per spec,
to support any one of the
- gEfiRngAlgorithmSp80090Ctr256Guid
- gEfiRngAlgorithmSp80090Hmac256Guid
- gEfiRngAlgorithmSp80090Hash256Guid
algorithms.
It's of course fine to require one of those algorithms, as a policy
decision, in this particular library instance -- but, as far as I can
tell, that decision does not follow from the spec.
Thanks
Laszlo
>
> Ref: https://bugzilla.tianocore.org/show_bug.cgi?id=1871
> Cc: Jiewen Yao <jiewen.yao@intel.com>
> Cc: Chao Zhang <chao.b.zhang@intel.com>
> Cc: Laszlo Ersek <lersek@redhat.com>
> Cc: Ard Biesheuvel <ard.biesheuvel@linaro.org>
> Cc: Matthew Carlson <macarl@microsoft.com>
> Cc: Sean Brogan <sean.brogan@microsoft.com>
> Cc: Bret Barkelew <bret.barkelew@microsoft.com>
> Cc: Liming Gao <liming.gao@intel.com>
> Cc: Ray Ni <ray.ni@intel.com>
> Signed-off-by: Jian J Wang <jian.j.wang@intel.com>
> ---
> .../DxeRngLibRngProtocol.c | 200 ++++++++++++++++++
> .../DxeRngLibRngProtocol.inf | 42 ++++
> .../DxeRngLibRngProtocol.uni | 14 ++
> 3 files changed, 256 insertions(+)
> create mode 100644 SecurityPkg/RandomNumberGenerator/DxeRngLibRngProtocol/DxeRngLibRngProtocol.c
> create mode 100644 SecurityPkg/RandomNumberGenerator/DxeRngLibRngProtocol/DxeRngLibRngProtocol.inf
> create mode 100644 SecurityPkg/RandomNumberGenerator/DxeRngLibRngProtocol/DxeRngLibRngProtocol.uni
>
> diff --git a/SecurityPkg/RandomNumberGenerator/DxeRngLibRngProtocol/DxeRngLibRngProtocol.c b/SecurityPkg/RandomNumberGenerator/DxeRngLibRngProtocol/DxeRngLibRngProtocol.c
> new file mode 100644
> index 0000000000..8ce4a7050d
> --- /dev/null
> +++ b/SecurityPkg/RandomNumberGenerator/DxeRngLibRngProtocol/DxeRngLibRngProtocol.c
> @@ -0,0 +1,200 @@
> +/** @file
> + Provides an implementation of the library class RngLib that uses the Rng protocol.
> +
> +Copyright (c) Microsoft Corporation. All rights reserved.
> +Copyright (c) 2019, Intel Corporation. All rights reserved.
> +SPDX-License-Identifier: BSD-2-Clause-Patent
> +
> +**/
> +#include <Uefi.h>
> +#include <Library/UefiBootServicesTableLib.h>
> +#include <Library/DebugLib.h>
> +#include <Library/RngLib.h>
> +#include <Protocol/Rng.h>
> +
> +/**
> + Generates a random number via the NIST 800-9A algorithm. Refer to
> + http://csrc.nist.gov/groups/STM/cavp/documents/drbg/DRBGVS.pdf
> + for more information.
> +
> + @param[out] Buffer Buffer to receive the random number.
> + @param[in] BufferSize Number of bytes in Buffer.
> +
> + @retval EFI_SUCCESS Random data generated successfully.
> + @retval Others Failed to generate the random number.
> +
> +**/
> +STATIC
> +EFI_STATUS
> +GenerateRandomNumberViaNist800Algorithm(
> + OUT UINT8* Buffer,
> + IN UINTN BufferSize
> + )
> +{
> + EFI_STATUS Status;
> + EFI_RNG_PROTOCOL* RngProtocol;
> +
> + Status = EFI_UNSUPPORTED;
> + RngProtocol = NULL;
> +
> + if (Buffer == NULL) {
> + DEBUG ((DEBUG_ERROR, "[%a] Buffer == NULL.\n", __FUNCTION__));
> + return EFI_INVALID_PARAMETER;
> + }
> +
> + if (gBS == NULL) {
> + DEBUG ((DEBUG_ERROR, "[%a] GenerateRandomNumber, gBS == NULL. Called too soon.\n", __FUNCTION__));
> + return EFI_LOAD_ERROR;
> + }
> +
> + Status = gBS->LocateProtocol (&gEfiRngProtocolGuid, NULL, (VOID **)&RngProtocol);
> + if (EFI_ERROR (Status) || RngProtocol == NULL) {
> + DEBUG ((DEBUG_ERROR, "[%a] Could not locate RNG prototocol, Status = %r\n", __FUNCTION__, Status));
> + return Status;
> + }
> +
> + Status = RngProtocol->GetRNG (RngProtocol, &gEfiRngAlgorithmSp80090Ctr256Guid, BufferSize, Buffer);
> + DEBUG ((DEBUG_VERBOSE, "[%a] GetRNG algorithm CTR-256 - Status = %r\n", __FUNCTION__, Status));
> + if (!EFI_ERROR (Status)) {
> + return Status;
> + }
> +
> + Status = RngProtocol->GetRNG (RngProtocol, &gEfiRngAlgorithmSp80090Hmac256Guid, BufferSize, Buffer);
> + DEBUG ((DEBUG_VERBOSE, "[%a] GetRNG algorithm HMAC-256 - Status = %r\n", __FUNCTION__, Status));
> + if (!EFI_ERROR (Status)) {
> + return Status;
> + }
> +
> + Status = RngProtocol->GetRNG (RngProtocol, &gEfiRngAlgorithmSp80090Hash256Guid, BufferSize, Buffer);
> + DEBUG ((DEBUG_VERBOSE, "[%a] GetRNG algorithm Hash-256 - Status = %r\n", __FUNCTION__, Status));
> + if (!EFI_ERROR (Status)) {
> + return Status;
> + }
> + //
> + // If we get to this point, we have failed
> + //
> + DEBUG((DEBUG_ERROR, "[%a] GetRNG() failed, staus = %r\n", __FUNCTION__, Status));
> +
> + return Status;
> +}
> +
> +
> +/**
> + Generates a 16-bit random number.
> +
> + if Rand is NULL, return FALSE.
> +
> + @param[out] Rand Buffer pointer to store the 16-bit random value.
> +
> + @retval TRUE Random number generated successfully.
> + @retval FALSE Failed to generate the random number.
> +
> +**/
> +BOOLEAN
> +EFIAPI
> +GetRandomNumber16 (
> + OUT UINT16 *Rand
> + )
> +{
> + EFI_STATUS Status;
> +
> + if (Rand == NULL) {
> + return FALSE;
> + }
> +
> + Status = GenerateRandomNumberViaNist800Algorithm ((UINT8 *)Rand, 2);
> + if (EFI_ERROR (Status)) {
> + return FALSE;
> + }
> + return TRUE;
> +}
> +
> +/**
> + Generates a 32-bit random number.
> +
> + if Rand is NULL, return FALSE.
> +
> + @param[out] Rand Buffer pointer to store the 32-bit random value.
> +
> + @retval TRUE Random number generated successfully.
> + @retval FALSE Failed to generate the random number.
> +
> +**/
> +BOOLEAN
> +EFIAPI
> +GetRandomNumber32 (
> + OUT UINT32 *Rand
> + )
> +{
> + EFI_STATUS Status;
> +
> + if (Rand == NULL) {
> + return FALSE;
> + }
> +
> + Status = GenerateRandomNumberViaNist800Algorithm ((UINT8 *)Rand, 4);
> + if (EFI_ERROR (Status)) {
> + return FALSE;
> + }
> + return TRUE;
> +}
> +
> +/**
> + Generates a 64-bit random number.
> +
> + if Rand is NULL, return FALSE.
> +
> + @param[out] Rand Buffer pointer to store the 64-bit random value.
> +
> + @retval TRUE Random number generated successfully.
> + @retval FALSE Failed to generate the random number.
> +
> +**/
> +BOOLEAN
> +EFIAPI
> +GetRandomNumber64 (
> + OUT UINT64 *Rand
> + )
> +{
> + EFI_STATUS Status;
> +
> + if (Rand == NULL) {
> + return FALSE;
> + }
> +
> + Status = GenerateRandomNumberViaNist800Algorithm ((UINT8 *)Rand, 8);
> + if (EFI_ERROR (Status)) {
> + return FALSE;
> + }
> + return TRUE;
> +}
> +
> +/**
> + Generates a 128-bit random number.
> +
> + if Rand is NULL, return FALSE.
> +
> + @param[out] Rand Buffer pointer to store the 128-bit random value.
> +
> + @retval TRUE Random number generated successfully.
> + @retval FALSE Failed to generate the random number.
> +
> +**/
> +BOOLEAN
> +EFIAPI
> +GetRandomNumber128 (
> + OUT UINT64 *Rand
> + )
> +{
> + EFI_STATUS Status;
> +
> + if (Rand == NULL) {
> + return FALSE;
> + }
> +
> + Status = GenerateRandomNumberViaNist800Algorithm ((UINT8 *)Rand, 16);
> + if (EFI_ERROR (Status)) {
> + return FALSE;
> + }
> + return TRUE;
> +}
> diff --git a/SecurityPkg/RandomNumberGenerator/DxeRngLibRngProtocol/DxeRngLibRngProtocol.inf b/SecurityPkg/RandomNumberGenerator/DxeRngLibRngProtocol/DxeRngLibRngProtocol.inf
> new file mode 100644
> index 0000000000..d47fe3be53
> --- /dev/null
> +++ b/SecurityPkg/RandomNumberGenerator/DxeRngLibRngProtocol/DxeRngLibRngProtocol.inf
> @@ -0,0 +1,42 @@
> +# @file
> +# Provides implementation of the library class RngLib that uses the RngProtocol
> +#
> +# @copyright
> +# Copyright (c) Microsoft Corporation. All rights reserved.
> +# SPDX-License-Identifier: BSD-2-Clause-Patent
> +#
> +##
> +
> +[Defines]
> + INF_VERSION = 0x00010029
> + BASE_NAME = DxeRngLibRngProtocol
> + MODULE_UNI_FILE = DxeRngLibRngProtocol.uni
> + FILE_GUID = FF9F84C5-A33E-44E3-9BB5-0D654B2D4149
> + MODULE_TYPE = DXE_DRIVER
> + VERSION_STRING = 1.0
> + LIBRARY_CLASS = RngLib|DXE_DRIVER DXE_RUNTIME_DRIVER DXE_SMM_DRIVER UEFI_APPLICATION UEFI_DRIVER
> +
> +#
> +# VALID_ARCHITECTURES = IA32 X64 EBC ARM AARCH64
> +#
> +
> +[Packages]
> + MdePkg/MdePkg.dec
> +
> +[Sources]
> + DxeRngLibRngProtocol.c
> +
> +[LibraryClasses]
> + DebugLib
> + UefiBootServicesTableLib
> +
> +[Protocols]
> + gEfiRngProtocolGuid ## CONSUMES
> +
> +[Depex]
> + gEfiRngProtocolGuid
> +
> +[Guids]
> + gEfiRngAlgorithmSp80090Ctr256Guid ## CONSUMES
> + gEfiRngAlgorithmSp80090Hash256Guid ## CONSUMES
> + gEfiRngAlgorithmSp80090Hmac256Guid ## CONSUMES
> diff --git a/SecurityPkg/RandomNumberGenerator/DxeRngLibRngProtocol/DxeRngLibRngProtocol.uni b/SecurityPkg/RandomNumberGenerator/DxeRngLibRngProtocol/DxeRngLibRngProtocol.uni
> new file mode 100644
> index 0000000000..09af056bd3
> --- /dev/null
> +++ b/SecurityPkg/RandomNumberGenerator/DxeRngLibRngProtocol/DxeRngLibRngProtocol.uni
> @@ -0,0 +1,14 @@
> +// /** @file
> +// Instance of RNG (Random Number Generator) Library Based on EFI_RNG_PROTOCOL.
> +//
> +// Copyright (c) 2019, Intel Corporation. All rights reserved.<BR>
> +//
> +// SPDX-License-Identifier: BSD-2-Clause-Patent
> +//
> +// **/
> +
> +
> +#string STR_MODULE_ABSTRACT #language en-US "Instance of RNG Library Based on EFI_RNG_PROTOCOL."
> +
> +#string STR_MODULE_DESCRIPTION #language en-US "This version of RNG library makes use of EFI_RNG_PROTOCOL to generate random number compliant with NIST 800-9A."
> +
>
-=-=-=-=-=-=-=-=-=-=-=-
Groups.io Links: You receive all messages sent to this group.
View/Reply Online (#50659): https://edk2.groups.io/g/devel/message/50659
Mute This Topic: https://groups.io/mt/56714115/1787277
Group Owner: devel+owner@edk2.groups.io
Unsubscribe: https://edk2.groups.io/g/devel/unsub [importer@patchew.org]
-=-=-=-=-=-=-=-=-=-=-=-
Laszlo,
> -----Original Message-----
> From: Laszlo Ersek <lersek@redhat.com>
> Sent: Thursday, November 14, 2019 7:16 PM
> To: devel@edk2.groups.io; Wang, Jian J <jian.j.wang@intel.com>
> Cc: Yao, Jiewen <jiewen.yao@intel.com>; Zhang, Chao B
> <chao.b.zhang@intel.com>; Ard Biesheuvel <ard.biesheuvel@linaro.org>;
> Matthew Carlson <macarl@microsoft.com>; Sean Brogan
> <sean.brogan@microsoft.com>; Bret Barkelew
> <bret.barkelew@microsoft.com>; Gao, Liming <liming.gao@intel.com>; Ni, Ray
> <ray.ni@intel.com>
> Subject: Re: [edk2-devel] [PATCH 06/11] SecurityPkg/DxeRngLibRngProtocol:
> add RNG protocol version of RngLib
>
> On 11/14/19 03:17, Wang, Jian J wrote:
> > From: Matthew Carlson <macarl@microsoft.com>
> >
> > This version of RngLib makes use of EFI_RNG_PROTOCOL to provide random
> > number. According to UEFI spec, EFI_RNG_PROTOCOL should meet NIST SP
> > 800-90 and/or ANSI X9.31 standards.
>
> I'd like to slightly correct the UEFI spec reference. In UEFI-2.8,
> section "37.5.1 EFI RNG Algorithm Definitions" writes,
>
> [...] The algorithms listed are optional, not meant to be exhaustive
> and may be augmented by vendors or other industry standards. [...]
>
> Meaning that an EFI_RNG_PROTOCOL instance is not "required", per spec,
> to support any one of the
> - gEfiRngAlgorithmSp80090Ctr256Guid
> - gEfiRngAlgorithmSp80090Hmac256Guid
> - gEfiRngAlgorithmSp80090Hash256Guid
> algorithms.
>
> It's of course fine to require one of those algorithms, as a policy
> decision, in this particular library instance -- but, as far as I can
> tell, that decision does not follow from the spec.
>
I think you're right about the spec. Although they're not "required"
ones, we can still suggest to follow the NIST/ANSI spec about random
entropy in the implementation of EFI_RNG_PROTOCOL.
Regards,
Jian
> Thanks
> Laszlo
>
> >
> > Ref: https://bugzilla.tianocore.org/show_bug.cgi?id=1871
> > Cc: Jiewen Yao <jiewen.yao@intel.com>
> > Cc: Chao Zhang <chao.b.zhang@intel.com>
> > Cc: Laszlo Ersek <lersek@redhat.com>
> > Cc: Ard Biesheuvel <ard.biesheuvel@linaro.org>
> > Cc: Matthew Carlson <macarl@microsoft.com>
> > Cc: Sean Brogan <sean.brogan@microsoft.com>
> > Cc: Bret Barkelew <bret.barkelew@microsoft.com>
> > Cc: Liming Gao <liming.gao@intel.com>
> > Cc: Ray Ni <ray.ni@intel.com>
> > Signed-off-by: Jian J Wang <jian.j.wang@intel.com>
> > ---
> > .../DxeRngLibRngProtocol.c | 200 ++++++++++++++++++
> > .../DxeRngLibRngProtocol.inf | 42 ++++
> > .../DxeRngLibRngProtocol.uni | 14 ++
> > 3 files changed, 256 insertions(+)
> > create mode 100644
> SecurityPkg/RandomNumberGenerator/DxeRngLibRngProtocol/DxeRngLibRngPr
> otocol.c
> > create mode 100644
> SecurityPkg/RandomNumberGenerator/DxeRngLibRngProtocol/DxeRngLibRngPr
> otocol.inf
> > create mode 100644
> SecurityPkg/RandomNumberGenerator/DxeRngLibRngProtocol/DxeRngLibRngPr
> otocol.uni
> >
> > diff --git
> a/SecurityPkg/RandomNumberGenerator/DxeRngLibRngProtocol/DxeRngLibRn
> gProtocol.c
> b/SecurityPkg/RandomNumberGenerator/DxeRngLibRngProtocol/DxeRngLibRn
> gProtocol.c
> > new file mode 100644
> > index 0000000000..8ce4a7050d
> > --- /dev/null
> > +++
> b/SecurityPkg/RandomNumberGenerator/DxeRngLibRngProtocol/DxeRngLibRn
> gProtocol.c
> > @@ -0,0 +1,200 @@
> > +/** @file
> > + Provides an implementation of the library class RngLib that uses the Rng
> protocol.
> > +
> > +Copyright (c) Microsoft Corporation. All rights reserved.
> > +Copyright (c) 2019, Intel Corporation. All rights reserved.
> > +SPDX-License-Identifier: BSD-2-Clause-Patent
> > +
> > +**/
> > +#include <Uefi.h>
> > +#include <Library/UefiBootServicesTableLib.h>
> > +#include <Library/DebugLib.h>
> > +#include <Library/RngLib.h>
> > +#include <Protocol/Rng.h>
> > +
> > +/**
> > + Generates a random number via the NIST 800-9A algorithm. Refer to
> > + http://csrc.nist.gov/groups/STM/cavp/documents/drbg/DRBGVS.pdf
> > + for more information.
> > +
> > + @param[out] Buffer Buffer to receive the random number.
> > + @param[in] BufferSize Number of bytes in Buffer.
> > +
> > + @retval EFI_SUCCESS Random data generated successfully.
> > + @retval Others Failed to generate the random number.
> > +
> > +**/
> > +STATIC
> > +EFI_STATUS
> > +GenerateRandomNumberViaNist800Algorithm(
> > + OUT UINT8* Buffer,
> > + IN UINTN BufferSize
> > + )
> > +{
> > + EFI_STATUS Status;
> > + EFI_RNG_PROTOCOL* RngProtocol;
> > +
> > + Status = EFI_UNSUPPORTED;
> > + RngProtocol = NULL;
> > +
> > + if (Buffer == NULL) {
> > + DEBUG ((DEBUG_ERROR, "[%a] Buffer == NULL.\n", __FUNCTION__));
> > + return EFI_INVALID_PARAMETER;
> > + }
> > +
> > + if (gBS == NULL) {
> > + DEBUG ((DEBUG_ERROR, "[%a] GenerateRandomNumber, gBS == NULL.
> Called too soon.\n", __FUNCTION__));
> > + return EFI_LOAD_ERROR;
> > + }
> > +
> > + Status = gBS->LocateProtocol (&gEfiRngProtocolGuid, NULL, (VOID
> **)&RngProtocol);
> > + if (EFI_ERROR (Status) || RngProtocol == NULL) {
> > + DEBUG ((DEBUG_ERROR, "[%a] Could not locate RNG prototocol, Status
> = %r\n", __FUNCTION__, Status));
> > + return Status;
> > + }
> > +
> > + Status = RngProtocol->GetRNG (RngProtocol,
> &gEfiRngAlgorithmSp80090Ctr256Guid, BufferSize, Buffer);
> > + DEBUG ((DEBUG_VERBOSE, "[%a] GetRNG algorithm CTR-256 - Status
> = %r\n", __FUNCTION__, Status));
> > + if (!EFI_ERROR (Status)) {
> > + return Status;
> > + }
> > +
> > + Status = RngProtocol->GetRNG (RngProtocol,
> &gEfiRngAlgorithmSp80090Hmac256Guid, BufferSize, Buffer);
> > + DEBUG ((DEBUG_VERBOSE, "[%a] GetRNG algorithm HMAC-256 - Status
> = %r\n", __FUNCTION__, Status));
> > + if (!EFI_ERROR (Status)) {
> > + return Status;
> > + }
> > +
> > + Status = RngProtocol->GetRNG (RngProtocol,
> &gEfiRngAlgorithmSp80090Hash256Guid, BufferSize, Buffer);
> > + DEBUG ((DEBUG_VERBOSE, "[%a] GetRNG algorithm Hash-256 - Status
> = %r\n", __FUNCTION__, Status));
> > + if (!EFI_ERROR (Status)) {
> > + return Status;
> > + }
> > + //
> > + // If we get to this point, we have failed
> > + //
> > + DEBUG((DEBUG_ERROR, "[%a] GetRNG() failed, staus = %r\n",
> __FUNCTION__, Status));
> > +
> > + return Status;
> > +}
> > +
> > +
> > +/**
> > + Generates a 16-bit random number.
> > +
> > + if Rand is NULL, return FALSE.
> > +
> > + @param[out] Rand Buffer pointer to store the 16-bit random value.
> > +
> > + @retval TRUE Random number generated successfully.
> > + @retval FALSE Failed to generate the random number.
> > +
> > +**/
> > +BOOLEAN
> > +EFIAPI
> > +GetRandomNumber16 (
> > + OUT UINT16 *Rand
> > + )
> > +{
> > + EFI_STATUS Status;
> > +
> > + if (Rand == NULL) {
> > + return FALSE;
> > + }
> > +
> > + Status = GenerateRandomNumberViaNist800Algorithm ((UINT8 *)Rand, 2);
> > + if (EFI_ERROR (Status)) {
> > + return FALSE;
> > + }
> > + return TRUE;
> > +}
> > +
> > +/**
> > + Generates a 32-bit random number.
> > +
> > + if Rand is NULL, return FALSE.
> > +
> > + @param[out] Rand Buffer pointer to store the 32-bit random value.
> > +
> > + @retval TRUE Random number generated successfully.
> > + @retval FALSE Failed to generate the random number.
> > +
> > +**/
> > +BOOLEAN
> > +EFIAPI
> > +GetRandomNumber32 (
> > + OUT UINT32 *Rand
> > + )
> > +{
> > + EFI_STATUS Status;
> > +
> > + if (Rand == NULL) {
> > + return FALSE;
> > + }
> > +
> > + Status = GenerateRandomNumberViaNist800Algorithm ((UINT8 *)Rand, 4);
> > + if (EFI_ERROR (Status)) {
> > + return FALSE;
> > + }
> > + return TRUE;
> > +}
> > +
> > +/**
> > + Generates a 64-bit random number.
> > +
> > + if Rand is NULL, return FALSE.
> > +
> > + @param[out] Rand Buffer pointer to store the 64-bit random value.
> > +
> > + @retval TRUE Random number generated successfully.
> > + @retval FALSE Failed to generate the random number.
> > +
> > +**/
> > +BOOLEAN
> > +EFIAPI
> > +GetRandomNumber64 (
> > + OUT UINT64 *Rand
> > + )
> > +{
> > + EFI_STATUS Status;
> > +
> > + if (Rand == NULL) {
> > + return FALSE;
> > + }
> > +
> > + Status = GenerateRandomNumberViaNist800Algorithm ((UINT8 *)Rand, 8);
> > + if (EFI_ERROR (Status)) {
> > + return FALSE;
> > + }
> > + return TRUE;
> > +}
> > +
> > +/**
> > + Generates a 128-bit random number.
> > +
> > + if Rand is NULL, return FALSE.
> > +
> > + @param[out] Rand Buffer pointer to store the 128-bit random value.
> > +
> > + @retval TRUE Random number generated successfully.
> > + @retval FALSE Failed to generate the random number.
> > +
> > +**/
> > +BOOLEAN
> > +EFIAPI
> > +GetRandomNumber128 (
> > + OUT UINT64 *Rand
> > + )
> > +{
> > + EFI_STATUS Status;
> > +
> > + if (Rand == NULL) {
> > + return FALSE;
> > + }
> > +
> > + Status = GenerateRandomNumberViaNist800Algorithm ((UINT8 *)Rand, 16);
> > + if (EFI_ERROR (Status)) {
> > + return FALSE;
> > + }
> > + return TRUE;
> > +}
> > diff --git
> a/SecurityPkg/RandomNumberGenerator/DxeRngLibRngProtocol/DxeRngLibRn
> gProtocol.inf
> b/SecurityPkg/RandomNumberGenerator/DxeRngLibRngProtocol/DxeRngLibRn
> gProtocol.inf
> > new file mode 100644
> > index 0000000000..d47fe3be53
> > --- /dev/null
> > +++
> b/SecurityPkg/RandomNumberGenerator/DxeRngLibRngProtocol/DxeRngLibRn
> gProtocol.inf
> > @@ -0,0 +1,42 @@
> > +# @file
> > +# Provides implementation of the library class RngLib that uses the
> RngProtocol
> > +#
> > +# @copyright
> > +# Copyright (c) Microsoft Corporation. All rights reserved.
> > +# SPDX-License-Identifier: BSD-2-Clause-Patent
> > +#
> > +##
> > +
> > +[Defines]
> > + INF_VERSION = 0x00010029
> > + BASE_NAME = DxeRngLibRngProtocol
> > + MODULE_UNI_FILE = DxeRngLibRngProtocol.uni
> > + FILE_GUID = FF9F84C5-A33E-44E3-9BB5-0D654B2D4149
> > + MODULE_TYPE = DXE_DRIVER
> > + VERSION_STRING = 1.0
> > + LIBRARY_CLASS = RngLib|DXE_DRIVER DXE_RUNTIME_DRIVER
> DXE_SMM_DRIVER UEFI_APPLICATION UEFI_DRIVER
> > +
> > +#
> > +# VALID_ARCHITECTURES = IA32 X64 EBC ARM AARCH64
> > +#
> > +
> > +[Packages]
> > + MdePkg/MdePkg.dec
> > +
> > +[Sources]
> > + DxeRngLibRngProtocol.c
> > +
> > +[LibraryClasses]
> > + DebugLib
> > + UefiBootServicesTableLib
> > +
> > +[Protocols]
> > + gEfiRngProtocolGuid ## CONSUMES
> > +
> > +[Depex]
> > + gEfiRngProtocolGuid
> > +
> > +[Guids]
> > + gEfiRngAlgorithmSp80090Ctr256Guid ## CONSUMES
> > + gEfiRngAlgorithmSp80090Hash256Guid ## CONSUMES
> > + gEfiRngAlgorithmSp80090Hmac256Guid ## CONSUMES
> > diff --git
> a/SecurityPkg/RandomNumberGenerator/DxeRngLibRngProtocol/DxeRngLibRn
> gProtocol.uni
> b/SecurityPkg/RandomNumberGenerator/DxeRngLibRngProtocol/DxeRngLibRn
> gProtocol.uni
> > new file mode 100644
> > index 0000000000..09af056bd3
> > --- /dev/null
> > +++
> b/SecurityPkg/RandomNumberGenerator/DxeRngLibRngProtocol/DxeRngLibRn
> gProtocol.uni
> > @@ -0,0 +1,14 @@
> > +// /** @file
> > +// Instance of RNG (Random Number Generator) Library Based on
> EFI_RNG_PROTOCOL.
> > +//
> > +// Copyright (c) 2019, Intel Corporation. All rights reserved.<BR>
> > +//
> > +// SPDX-License-Identifier: BSD-2-Clause-Patent
> > +//
> > +// **/
> > +
> > +
> > +#string STR_MODULE_ABSTRACT #language en-US "Instance of RNG
> Library Based on EFI_RNG_PROTOCOL."
> > +
> > +#string STR_MODULE_DESCRIPTION #language en-US "This version of
> RNG library makes use of EFI_RNG_PROTOCOL to generate random number
> compliant with NIST 800-9A."
> > +
> >
-=-=-=-=-=-=-=-=-=-=-=-
Groups.io Links: You receive all messages sent to this group.
View/Reply Online (#50673): https://edk2.groups.io/g/devel/message/50673
Mute This Topic: https://groups.io/mt/56714115/1787277
Group Owner: devel+owner@edk2.groups.io
Unsubscribe: https://edk2.groups.io/g/devel/unsub [importer@patchew.org]
-=-=-=-=-=-=-=-=-=-=-=-
© 2016 - 2024 Red Hat, Inc.