From df944f52986f17bca53f3aebc483d4eba3de56fe Mon Sep 17 00:00:00 2001 From: Antara Borwankar Date: Wed, 22 Jan 2025 18:18:41 +0530 Subject: [PATCH] feat: Add FIPS self test support Added fips_selftest run before any crypto use in Stage1A. updated IppCrypto to 1.0.1 version Signed-off-by: Antara Borwankar --- BootloaderCommonPkg/BootloaderCommonPkg.dec | 10 + .../Include/Library/CryptoLib.h | 34 ++ .../Library/IppCrypto2Lib/IppCrypto2Lib.inf | 26 +- .../Library/IppCrypto2Lib/IppCrypto2LibE9.inf | 88 +++- .../Library/IppCrypto2Lib/IppCrypto2LibL9.inf | 97 ++++- .../Library/IppCrypto2Lib/IppCrypto2LibM7.inf | 89 +++- .../Library/IppCrypto2Lib/IppCrypto2LibU8.inf | 84 +++- .../Library/IppCrypto2Lib/IppCrypto2LibY8.inf | 87 +++- .../Library/IppCrypto2Lib/fips.c | 411 ++++++++++++++++++ .../Library/IppCrypto2Lib/ipp-crypto | 2 +- .../Library/IppCrypto2Lib/rsa_verify.c | 8 +- .../LoaderPerformancePrintLib.c | 2 + .../Library/SecureBootLib/SecureBootLib.inf | 3 + .../Library/SecureBootLib/SecureBootRsa.c | 5 + BootloaderCorePkg/BootloaderCorePkg.dsc | 2 + BootloaderCorePkg/Stage1A/Stage1A.c | 12 + BootloaderCorePkg/Stage1A/Stage1A.h | 1 + BootloaderCorePkg/Stage1A/Stage1A.inf | 4 + BuildLoader.py | 1 + Platform/ArrowlakeBoardPkg/BoardConfigArlh.py | 9 +- Platform/ArrowlakeBoardPkg/BoardConfigArls.py | 8 + 21 files changed, 917 insertions(+), 66 deletions(-) create mode 100644 BootloaderCommonPkg/Library/IppCrypto2Lib/fips.c diff --git a/BootloaderCommonPkg/BootloaderCommonPkg.dec b/BootloaderCommonPkg/BootloaderCommonPkg.dec index 478e684f..8dbb41cc 100644 --- a/BootloaderCommonPkg/BootloaderCommonPkg.dec +++ b/BootloaderCommonPkg/BootloaderCommonPkg.dec @@ -157,6 +157,12 @@ # 0x04 - SM3_256.
gPlatformCommonLibTokenSpaceGuid.PcdCompSignHashAlg | 0x01| UINT8 | 0x20000702 + ## This PCD indicates the signing scheme type used for Component signing + # Based on the value set, the required algorithm should be used while verfication + # 0x0001 - RSA_PKCS_1_5.
+ # 0x0002 - RSA_PSS.
+ gPlatformCommonLibTokenSpaceGuid.PcdCompSignType | 0x02| UINT8 | 0x20000228 + ## This PCD indicates the signing scheme type included in IPP Crypto library # Based on the value set, the required algorithm should be used while verfication # 0x0001 - RSA_PKCS_1_5.
@@ -345,3 +351,7 @@ gPlatformCommonLibTokenSpaceGuid.PcdCpuX2ApicEnabled | FALSE | BOOLEAN | 0x20000220 gPlatformCommonLibTokenSpaceGuid.PcdTccEnabled | FALSE | BOOLEAN | 0x20000221 gPlatformCommonLibTokenSpaceGuid.PcdFspNoEop | FALSE | BOOLEAN | 0x20000223 + +[PcdsFixedAtBuild] + gPlatformCommonLibTokenSpaceGuid.PcdFipsSupport | FALSE | BOOLEAN | 0x20000226 + gPlatformCommonLibTokenSpaceGuid.PcdIppcrypto2Lib | FALSE | BOOLEAN | 0x20000227 diff --git a/BootloaderCommonPkg/Include/Library/CryptoLib.h b/BootloaderCommonPkg/Include/Library/CryptoLib.h index 31c5f5a9..2fb575c4 100644 --- a/BootloaderCommonPkg/Include/Library/CryptoLib.h +++ b/BootloaderCommonPkg/Include/Library/CryptoLib.h @@ -174,6 +174,29 @@ Sm3 ( OUT UINT8 *Digest ); +/** + Verifies the RSA signature with PKCS1-v1_5 encoding scheme defined in RSA PKCS#1. + + @param[in] PubKeyHdr Pointer to a PubKey data. + @param[in] SignatureHdr Pointer to signature data to be verified. + @param[in] Src Pointer to meassage. + @param[in] SrcSize Size of the message. + + @retval RETURN_SUCCESS Valid signature. + @retval RETURN_INVALID_PARAMETER Key or signature format is incorrect. + @retval RETURN_SECURITY_VIOLATION Invalid signature. + +**/ + +RETURN_STATUS +EFIAPI +RsaVerify2_Pkcs_1_5 ( + IN CONST PUB_KEY_HDR *PubKeyHdr, + IN CONST SIGNATURE_HDR *SignatureHdr, + IN CONST UINT8 *Src, + IN CONST UINT32 SrcSize + ); + /** Verifies the RSA signature with PKCS1-v1_5 encoding scheme defined in RSA PKCS#1. @@ -434,5 +457,16 @@ Sm3Final ( OUT UINT8 *Hash ); +/** + Runs FIPS self test before any crypto function gets executed. + + @retval RETURN_SUCCESS Success. + @retval RETURN_UNSUPPORTED All other errors. +**/ +RETURN_STATUS +EFIAPI +RunFipsSelftests ( + VOID +); #endif diff --git a/BootloaderCommonPkg/Library/IppCrypto2Lib/IppCrypto2Lib.inf b/BootloaderCommonPkg/Library/IppCrypto2Lib/IppCrypto2Lib.inf index 9c05f510..c8c75ac2 100644 --- a/BootloaderCommonPkg/Library/IppCrypto2Lib/IppCrypto2Lib.inf +++ b/BootloaderCommonPkg/Library/IppCrypto2Lib/IppCrypto2Lib.inf @@ -68,7 +68,6 @@ $(IPP_PATH)/sources/ippcp/pcprsa_initpublickey.c $(IPP_PATH)/sources/ippcp/pcprsa_setpublickey.c $(IPP_PATH)/sources/ippcp/pcprsa_sizeof_pubkey.h - $(IPP_PATH)/sources/ippcp/pcprsaverifyhash_pkcs1v15_rmf.c $(IPP_PATH)/sources/ippcp/pcprsaverify_pss_rmf.c $(IPP_PATH)/sources/ippcp/pcprsa_gspub_cipher.c $(IPP_PATH)/sources/ippcp/gsmodmethod_rsa.c @@ -76,17 +75,18 @@ $(IPP_PATH)/sources/ippcp/pcprsa_gsmethod__gpr_public.c # Hash source files - $(IPP_PATH)/sources/ippcp/pcphashmethod_sha256.c - $(IPP_PATH)/sources/ippcp/pcphashsha256px.c - $(IPP_PATH)/sources/ippcp/pcphashmethod_sha384.c - $(IPP_PATH)/sources/ippcp/pcphashsha512px.c - $(IPP_PATH)/sources/ippcp/sm3/pcphashmethod_sm3.c - $(IPP_PATH)/sources/ippcp/sm3/pcphashsm3px.c - $(IPP_PATH)/sources/ippcp/pcphashmessage_rmf.c - $(IPP_PATH)/sources/ippcp/pcphashinit_rmf.c - $(IPP_PATH)/sources/ippcp/pcphashupdate_rmf.c - $(IPP_PATH)/sources/ippcp/pcphashfinal_rmf.c - $(IPP_PATH)/sources/ippcp/pcphashca_rmf.c + $(IPP_PATH)/sources/ippcp/hash/sha256/pcphashmethod_sha256.c + $(IPP_PATH)/sources/ippcp/hash/sha256/pcphashsha256px.c + $(IPP_PATH)/sources/ippcp/hash/sha384/pcphashmethod_sha384.c + $(IPP_PATH)/sources/ippcp/hash/sha512/pcphashsha512px.c + $(IPP_PATH)/sources/ippcp/hash/sm3/pcphashmethod_sm3.c + $(IPP_PATH)/sources/ippcp/hash/sm3/pcphashsm3px.c + $(IPP_PATH)/sources/ippcp/hash/pcphashmessage_rmf.c + $(IPP_PATH)/sources/ippcp/hash/pcphashinit_rmf.c + $(IPP_PATH)/sources/ippcp/hash/pcphashupdate_rmf.c + $(IPP_PATH)/sources/ippcp/hash/pcphashfinal_rmf.c + $(IPP_PATH)/sources/ippcp/hash/pcphashca_rmf.c + $(IPP_PATH)/sources/ippcp/pcprsaverify_pkcs1v15_rmf.c # HMAC source files $(IPP_PATH)/sources/ippcp/pcphmacmessage_rmf.c @@ -108,6 +108,8 @@ gPlatformCommonLibTokenSpaceGuid.PcdCryptoShaOptMask gPlatformCommonLibTokenSpaceGuid.PcdIppHashLibSupportedMask gPlatformCommonLibTokenSpaceGuid.PcdCompSignSchemeSupportedMask + gPlatformCommonLibTokenSpaceGuid.PcdCompSignHashAlg + gPlatformCommonLibTokenSpaceGuid.PcdCompSignType [BuildOptions] MSFT:*_*_*_CC_FLAGS = -D_ABL_ /GL- diff --git a/BootloaderCommonPkg/Library/IppCrypto2Lib/IppCrypto2LibE9.inf b/BootloaderCommonPkg/Library/IppCrypto2Lib/IppCrypto2LibE9.inf index 1c575a08..a443b003 100644 --- a/BootloaderCommonPkg/Library/IppCrypto2Lib/IppCrypto2LibE9.inf +++ b/BootloaderCommonPkg/Library/IppCrypto2Lib/IppCrypto2LibE9.inf @@ -73,7 +73,7 @@ $(IPP_PATH)/sources/ippcp/pcprsa_initpublickey.c $(IPP_PATH)/sources/ippcp/pcprsa_setpublickey.c $(IPP_PATH)/sources/ippcp/pcprsa_sizeof_pubkey.h - $(IPP_PATH)/sources/ippcp/pcprsaverifyhash_pkcs1v15_rmf.c + $(IPP_PATH)/sources/ippcp/pcprsaverify_pkcs1v15_rmf.c $(IPP_PATH)/sources/ippcp/pcprsaverify_pss_rmf.c $(IPP_PATH)/sources/ippcp/pcprsa_gspub_cipher.c $(IPP_PATH)/sources/ippcp/gsmodmethod_rsa.c @@ -81,12 +81,14 @@ $(IPP_PATH)/sources/ippcp/pcprsa_gsmethod__gpr_public.c # Hash source files - $(IPP_PATH)/sources/ippcp/pcphashmessage_rmf.c - $(IPP_PATH)/sources/ippcp/pcphashinit_rmf.c - $(IPP_PATH)/sources/ippcp/pcphashupdate_rmf.c - $(IPP_PATH)/sources/ippcp/pcphashfinal_rmf.c - $(IPP_PATH)/sources/ippcp/pcphashca_rmf.c - $(IPP_PATH)/sources/ippcp/sm3/pcpsm3stuff.h + $(IPP_PATH)/sources/ippcp/hash/pcphashmessage_rmf.c + $(IPP_PATH)/sources/ippcp/hash/pcphashinit_rmf.c + $(IPP_PATH)/sources/ippcp/hash/pcphashupdate_rmf.c + $(IPP_PATH)/sources/ippcp/hash/pcphashfinal_rmf.c + $(IPP_PATH)/sources/ippcp/hash/pcphashca_rmf.c + $(IPP_PATH)/sources/ippcp/hash/sm3/pcpsm3stuff.h + $(IPP_PATH)/sources/ippcp/hash/sha512/pcpsha512stuff.h + $(IPP_PATH)/sources/ippcp/hash/sha256/pcpsha256stuff.h # HMAC source files $(IPP_PATH)/sources/ippcp/pcphmacmessage_rmf.c @@ -95,12 +97,73 @@ $(IPP_PATH)/sources/ippcp/pcphmacupdate_rmf.c $(IPP_PATH)/sources/ippcp/pcphmacfinal_rmf.c + # FIPS source files + fips.c + $(IPP_PATH)/include/ippcp/fips_cert.h + $(IPP_PATH)/sources/ippcp/fips_cert/common.c + $(IPP_PATH)/sources/ippcp/fips_cert/selftest_rsa_sign_verify_pkcs_v15.c + $(IPP_PATH)/sources/ippcp/pcprsaverify_pkcs1v15_rmf.c + $(IPP_PATH)/sources/ippcp/pcprsa_getbuffersizeprivatekey.c + $(IPP_PATH)/sources/ippcp/pcprsa_setprivatekeytype1.c + $(IPP_PATH)/sources/ippcp/pcprsa_initprivatekeytype1.c + $(IPP_PATH)/sources/ippcp/pcprsa_getsizeprivatekeytype1.c + $(IPP_PATH)/sources/ippcp/pcpbnsetwords.c + $(IPP_PATH)/sources/ippcp/pcprsasign_pkcs1v15_rmf.c + $(IPP_PATH)/sources/ippcp/hash/sha256/pcphashmethodset_sha256_tt.c + $(IPP_PATH)/sources/ippcp/pcprsa_gsmethod__gpr_private.c + $(IPP_PATH)/sources/ippcp/pcprsa_gsprv_cipher_crt.c + $(IPP_PATH)/sources/ippcp/pcprsa_gsprv_cipher.c + $(IPP_PATH)/sources/ippcp/pcpngmontexpstuff_win_sscm.c + $(IPP_PATH)/sources/ippcp/pcpngmontexpstuff_win.c + $(IPP_PATH)/sources/ippcp/gsscramble.c + $(IPP_PATH)/sources/ippcp/gsscramble_sscm.c + $(IPP_PATH)/sources/ippcp/fips_cert/selftest_hash_msg_upd_sha.c + $(IPP_PATH)/sources/ippcp/hash/sha512/pcphashmethodset_sha512.c + $(IPP_PATH)/sources/ippcp/hash/pcphashgetsize_rmf.c + $(IPP_PATH)/sources/ippcp/hash/pcphashgettag_rmf.c + $(IPP_PATH)/sources/ippcp/fips_cert/selftest_aes_upd_hmac.c + $(IPP_PATH)/sources/ippcp/pcphmacgettag_rmf.c + $(IPP_PATH)/sources/ippcp/pcphmacduplicate_rmf.c + $(IPP_PATH)/sources/ippcp/hash/pcphashcnt.c + $(IPP_PATH)/sources/ippcp/hash/pcphashduplicate_rmf.c + $(IPP_PATH)/sources/ippcp/fips_cert/selftest_rsa_sign_verify_pss.c + $(IPP_PATH)/sources/ippcp/cpinit.c + $(IPP_PATH)/sources/ippcp/pcprsasign_pss_rmf.c + $(IPP_PATH)/sources/ippcp/pcprsa_generatekeys.c + $(IPP_PATH)/sources/ippcp/pcprsa_initprivatekeytype2.c + $(IPP_PATH)/sources/ippcp/pcprsa_getsizeprivatekeytype2.c + $(IPP_PATH)/sources/ippcp/pcpprimeginitca.c + $(IPP_PATH)/sources/ippcp/pcpprimegetsize.c + $(IPP_PATH)/sources/ippcp/pcpprngenca.c + $(IPP_PATH)/sources/ippcp/pcpprnginitca.c + $(IPP_PATH)/sources/ippcp/pcpprnggetsize.c + $(IPP_PATH)/sources/ippcp/pcpprngen_range.c + $(IPP_PATH)/sources/ippcp/pcpprngen_pattern.c + $(IPP_PATH)/sources/ippcp/pcpprime_mimimaltest.c + $(IPP_PATH)/sources/ippcp/pcpbn_val3.c + $(IPP_PATH)/sources/ippcp/pcpbn_val1.c + $(IPP_PATH)/sources/ippcp/pcpbnu_lsr.c + $(IPP_PATH)/sources/ippcp/pcpbnu_ntz.c + $(IPP_PATH)/sources/ippcp/pcpbnu_arith_minv.c + $(IPP_PATH)/sources/ippcp/pcpbnarithgcd.c + $(IPP_PATH)/sources/ippcp/gsmodmethod_mont.c + $(IPP_PATH)/sources/ippcp/pcpprng_gen.c + $(IPP_PATH)/sources/ippcp/pcpbnu_arith_gcd.c + $(IPP_PATH)/sources/ippcp/pcpbnu32_arith_muldigit.c + $(IPP_PATH)/sources/ippcp/hash/pcphashmethodgetsize.c + [Sources.X64] $(IPP_PATH)/sources/ippcp/asm_ia32/pcpvariant_xmm7560.inc # E9 files $(IPP_PATH)/sources/ippcp/asm_intel64/pcpsha256e9as.nasm $(IPP_PATH)/sources/ippcp/asm_intel64/pcpsm3e9as.nasm $(IPP_PATH)/sources/ippcp/asm_intel64/pcpsha512e9as.nasm + # FIPS + $(IPP_PATH)/sources/ippcp/asm_intel64/pcpbnumaconem7as.nasm + $(IPP_PATH)/sources/ippcp/asm_intel64/cpinitas.nasm + $(IPP_PATH)/sources/ippcp/asm_intel64/pcpsha1e9as.nasm + $(IPP_PATH)/sources/ippcp/asm_intel64/pcpsha1nias.nasm + $(IPP_PATH)/sources/ippcp/asm_intel64/pcpsha256nias.nasm # M7 files $(IPP_PATH)/sources/ippcp/asm_intel64/pcpbnuaddm7as.nasm $(IPP_PATH)/sources/ippcp/asm_intel64/pcpbnudivm7as.nasm @@ -124,6 +187,11 @@ $(IPP_PATH)/sources/ippcp/asm_intel64/pcpbnusqrschoolm7as.asm : $(IPP_PATH)/sources/ippcp/asm_intel64/pcpbnusqrschoolm7as.nasm $(IPP_PATH)/sources/ippcp/asm_intel64/pcpmontreductionm7as.asm : $(IPP_PATH)/sources/ippcp/asm_intel64/pcpmontreductionm7as.nasm $(IPP_PATH)/sources/ippcp/asm_intel64/pcppurgeblkm7as.asm : $(IPP_PATH)/sources/ippcp/asm_intel64/pcppurgeblkm7as.nasm + $(IPP_PATH)/sources/ippcp/asm_intel64/pcpbnumaconem7as.asm : $(IPP_PATH)/sources/ippcp/asm_intel64/pcpbnumaconem7as.nasm + $(IPP_PATH)/sources/ippcp/asm_intel64/cpinitas.asm : $(IPP_PATH)/sources/ippcp/asm_intel64/cpinitas.nasm + $(IPP_PATH)/sources/ippcp/asm_intel64/pcpsha1e9as.asm : $(IPP_PATH)/sources/ippcp/asm_intel64/pcpsha1e9as.nasm + $(IPP_PATH)/sources/ippcp/asm_intel64/pcpsha1nias.asm : $(IPP_PATH)/sources/ippcp/asm_intel64/pcpsha1nias.nasm + $(IPP_PATH)/sources/ippcp/asm_intel64/pcpsha256nias.asm : $(IPP_PATH)/sources/ippcp/asm_intel64/pcpsha256nias.nasm [Packages] @@ -139,10 +207,12 @@ gPlatformCommonLibTokenSpaceGuid.PcdCryptoShaOptMask gPlatformCommonLibTokenSpaceGuid.PcdIppHashLibSupportedMask gPlatformCommonLibTokenSpaceGuid.PcdCompSignSchemeSupportedMask + gPlatformCommonLibTokenSpaceGuid.PcdCompSignHashAlg + gPlatformCommonLibTokenSpaceGuid.PcdCompSignType [BuildOptions] - MSFT:*_*_*_CC_FLAGS = -D_ABL_ -D_E9 /GL- /arch:AVX + MSFT:*_*_*_CC_FLAGS = -D_ABL_ -D_E9 -DIPPCP_FIPS_MODE -D_ARCH_EM64T -D_NO_IPP_DEPRECATED /GL- /arch:AVX MSFT:*_*_X64_NASM_FLAGS = -D_ABL_ -D_E9 -DWIN32E GCC:*_*_X64_NASM_FLAGS = -D_ABL_ -D_E9 -DLINUX32E - GCC:*_*_*_CC_FLAGS = -D_ABL_ -D_E9 -w -Wformat -Wformat-security -march=sandybridge -mavx -maes -mpclmul -msha -mrdrnd -mrdseed + GCC:*_*_*_CC_FLAGS = -D_ABL_ -D_E9 -w -Wformat -Wformat-security -march=sandybridge -mavx -maes -mpclmul -msha -mrdrnd -mrdseed -DIPPCP_FIPS_MODE -D_ARCH_EM64T -D_NO_IPP_DEPRECATED -DMBX_FIPS_MODE diff --git a/BootloaderCommonPkg/Library/IppCrypto2Lib/IppCrypto2LibL9.inf b/BootloaderCommonPkg/Library/IppCrypto2Lib/IppCrypto2LibL9.inf index 50017908..2d784daa 100644 --- a/BootloaderCommonPkg/Library/IppCrypto2Lib/IppCrypto2LibL9.inf +++ b/BootloaderCommonPkg/Library/IppCrypto2Lib/IppCrypto2LibL9.inf @@ -75,7 +75,7 @@ $(IPP_PATH)/sources/ippcp/pcprsa_initpublickey.c $(IPP_PATH)/sources/ippcp/pcprsa_setpublickey.c $(IPP_PATH)/sources/ippcp/pcprsa_sizeof_pubkey.h - $(IPP_PATH)/sources/ippcp/pcprsaverifyhash_pkcs1v15_rmf.c + $(IPP_PATH)/sources/ippcp/pcprsaverify_pkcs1v15_rmf.c $(IPP_PATH)/sources/ippcp/pcprsaverify_pss_rmf.c $(IPP_PATH)/sources/ippcp/pcprsa_gspub_cipher.c $(IPP_PATH)/sources/ippcp/gsmodmethod_rsa.c @@ -83,12 +83,14 @@ $(IPP_PATH)/sources/ippcp/pcprsa_gsmethod__gpr_public.c # Hash source files - $(IPP_PATH)/sources/ippcp/pcphashmessage_rmf.c - $(IPP_PATH)/sources/ippcp/pcphashinit_rmf.c - $(IPP_PATH)/sources/ippcp/pcphashupdate_rmf.c - $(IPP_PATH)/sources/ippcp/pcphashfinal_rmf.c - $(IPP_PATH)/sources/ippcp/pcphashca_rmf.c - $(IPP_PATH)/sources/ippcp/sm3/pcpsm3stuff.h + $(IPP_PATH)/sources/ippcp/hash/pcphashmessage_rmf.c + $(IPP_PATH)/sources/ippcp/hash/pcphashinit_rmf.c + $(IPP_PATH)/sources/ippcp/hash/pcphashupdate_rmf.c + $(IPP_PATH)/sources/ippcp/hash/pcphashfinal_rmf.c + $(IPP_PATH)/sources/ippcp/hash/pcphashca_rmf.c + $(IPP_PATH)/sources/ippcp/hash/sm3/pcpsm3stuff.h + $(IPP_PATH)/sources/ippcp/hash/sha256/pcpsha256stuff.h + $(IPP_PATH)/sources/ippcp/hash/sha512/pcpsha512stuff.h # HMAC source files $(IPP_PATH)/sources/ippcp/pcphmacmessage_rmf.c @@ -97,7 +99,73 @@ $(IPP_PATH)/sources/ippcp/pcphmacupdate_rmf.c $(IPP_PATH)/sources/ippcp/pcphmacfinal_rmf.c + # FIPS source files + fips.c + $(IPP_PATH)/include/ippcp/fips_cert.h + $(IPP_PATH)/sources/ippcp/fips_cert/common.c + $(IPP_PATH)/sources/ippcp/fips_cert/selftest_rsa_sign_verify_pkcs_v15.c + $(IPP_PATH)/sources/ippcp/pcprsaverify_pkcs1v15_rmf.c + $(IPP_PATH)/sources/ippcp/pcprsa_getbuffersizeprivatekey.c + $(IPP_PATH)/sources/ippcp/pcprsa_setprivatekeytype1.c + $(IPP_PATH)/sources/ippcp/pcprsa_initprivatekeytype1.c + $(IPP_PATH)/sources/ippcp/pcprsa_getsizeprivatekeytype1.c + $(IPP_PATH)/sources/ippcp/pcpbnsetwords.c + $(IPP_PATH)/sources/ippcp/pcprsasign_pkcs1v15_rmf.c + $(IPP_PATH)/sources/ippcp/hash/sha256/pcphashmethodset_sha256_tt.c + $(IPP_PATH)/sources/ippcp/pcprsa_gsmethod__gpr_private.c + $(IPP_PATH)/sources/ippcp/pcprsa_gsprv_cipher_crt.c + $(IPP_PATH)/sources/ippcp/pcprsa_gsprv_cipher.c + $(IPP_PATH)/sources/ippcp/pcpngmontexpstuff_win_sscm.c + $(IPP_PATH)/sources/ippcp/pcpngmontexpstuff_win.c + $(IPP_PATH)/sources/ippcp/gsscramble.c + $(IPP_PATH)/sources/ippcp/gsscramble_sscm.c + $(IPP_PATH)/sources/ippcp/fips_cert/selftest_hash_msg_upd_sha.c + $(IPP_PATH)/sources/ippcp/hash/sha512/pcphashmethodset_sha512.c + $(IPP_PATH)/sources/ippcp/hash/pcphashgetsize_rmf.c + $(IPP_PATH)/sources/ippcp/hash/pcphashgettag_rmf.c + $(IPP_PATH)/sources/ippcp/fips_cert/selftest_aes_upd_hmac.c + $(IPP_PATH)/sources/ippcp/pcphmacgettag_rmf.c + $(IPP_PATH)/sources/ippcp/pcphmacduplicate_rmf.c + $(IPP_PATH)/sources/ippcp/hash/pcphashcnt.c + $(IPP_PATH)/sources/ippcp/hash/pcphashduplicate_rmf.c + $(IPP_PATH)/sources/ippcp/fips_cert/selftest_rsa_sign_verify_pss.c + $(IPP_PATH)/sources/ippcp/cpinit.c + $(IPP_PATH)/sources/ippcp/pcprsasign_pss_rmf.c + $(IPP_PATH)/sources/ippcp/pcprsa_generatekeys.c + $(IPP_PATH)/sources/ippcp/pcprsa_initprivatekeytype2.c + $(IPP_PATH)/sources/ippcp/pcprsa_getsizeprivatekeytype2.c + $(IPP_PATH)/sources/ippcp/pcpprimeginitca.c + $(IPP_PATH)/sources/ippcp/pcpprimegetsize.c + $(IPP_PATH)/sources/ippcp/pcpprngenca.c + $(IPP_PATH)/sources/ippcp/pcpprnginitca.c + $(IPP_PATH)/sources/ippcp/pcpprnggetsize.c + $(IPP_PATH)/sources/ippcp/pcpprngen_range.c + $(IPP_PATH)/sources/ippcp/pcpprngen_pattern.c + $(IPP_PATH)/sources/ippcp/pcpprime_mimimaltest.c + $(IPP_PATH)/sources/ippcp/pcpbn_val3.c + $(IPP_PATH)/sources/ippcp/pcpbn_val1.c + $(IPP_PATH)/sources/ippcp/pcpbnu_lsr.c + $(IPP_PATH)/sources/ippcp/pcpbnu_ntz.c + $(IPP_PATH)/sources/ippcp/pcpbnu_arith_minv.c + $(IPP_PATH)/sources/ippcp/pcpbnarithgcd.c + $(IPP_PATH)/sources/ippcp/gsmodmethod_mont.c + $(IPP_PATH)/sources/ippcp/pcpprng_gen.c + $(IPP_PATH)/sources/ippcp/pcpbnu_arith_gcd.c + $(IPP_PATH)/sources/ippcp/pcpbnu32_arith_muldigit.c + $(IPP_PATH)/sources/ippcp/hash/pcphashmethodgetsize.c + $(IPP_PATH)/sources/ippcp/pcprsa_gsmethod__avx2_private.c + $(IPP_PATH)/sources/ippcp/pcpngmontexpstuff_avx2.c + [Sources.X64] + # FIPS + $(IPP_PATH)/sources/ippcp/asm_intel64/pcpbnumaconem7as.nasm + $(IPP_PATH)/sources/ippcp/asm_intel64/pcpsha1nias.nasm + $(IPP_PATH)/sources/ippcp/asm_intel64/pcpsha256nias.nasm + $(IPP_PATH)/sources/ippcp/asm_intel64/pcpsha1l9as.nasm + $(IPP_PATH)/sources/ippcp/asm_intel64/pcpmontmul1024_avx2as.nasm + $(IPP_PATH)/sources/ippcp/asm_intel64/pcpmontmul_avx2as.nasm + $(IPP_PATH)/sources/ippcp/asm_intel64/pcpmontsqr1024_avx2as.nasm + $(IPP_PATH)/sources/ippcp/asm_intel64/pcpmontsqr_avx2as.nasm #L9 files $(IPP_PATH)/sources/ippcp/asm_intel64/cpinitas.nasm $(IPP_PATH)/sources/ippcp/asm_intel64/pcpsha256l9as.nasm @@ -126,6 +194,15 @@ $(IPP_PATH)/sources/ippcp/asm_intel64/pcpbnumulschoolsrvl9.asm : $(IPP_PATH)/sources/ippcp/asm_intel64/pcpbnumulschoolsrvl9as.nasm $(IPP_PATH)/sources/ippcp/asm_intel64/pcpbnumulschoolsrvl9pp.asm : $(IPP_PATH)/sources/ippcp/asm_intel64/pcpbnumulschoolsrvl9pp.nasm $(IPP_PATH)/sources/ippcp/asm_intel64/pcppurgeblkm7as.asm : $(IPP_PATH)/sources/ippcp/asm_intel64/pcppurgeblkm7as.nasm + $(IPP_PATH)/sources/ippcp/asm_intel64/pcpbnumaconem7as.asm : $(IPP_PATH)/sources/ippcp/asm_intel64/pcpbnumaconem7as.nasm + $(IPP_PATH)/sources/ippcp/asm_intel64/pcpsha1nias.asm : $(IPP_PATH)/sources/ippcp/asm_intel64/pcpsha1nias.nasm + $(IPP_PATH)/sources/ippcp/asm_intel64/pcpsha256nias.asm : $(IPP_PATH)/sources/ippcp/asm_intel64/pcpsha256nias.nasm + $(IPP_PATH)/sources/ippcp/asm_intel64/pcpsha1l9as.asm : $(IPP_PATH)/sources/ippcp/asm_intel64/pcpsha1l9as.nasm + $(IPP_PATH)/sources/ippcp/asm_intel64/pcpmontmul1024_avx2as.asm : $(IPP_PATH)/sources/ippcp/asm_intel64/pcpmontmul1024_avx2as.nasm + $(IPP_PATH)/sources/ippcp/asm_intel64/pcpmontmul_avx2as.asm : $(IPP_PATH)/sources/ippcp/asm_intel64/pcpmontmul_avx2as.nasm + $(IPP_PATH)/sources/ippcp/asm_intel64/pcpmontsqr1024_avx2as.asm : $(IPP_PATH)/sources/ippcp/asm_intel64/pcpmontsqr1024_avx2as.nasm + $(IPP_PATH)/sources/ippcp/asm_intel64/pcpmontsqr_avx2as.asm : $(IPP_PATH)/sources/ippcp/asm_intel64/pcpmontsqr_avx2as.nasm + [Packages] @@ -141,10 +218,12 @@ gPlatformCommonLibTokenSpaceGuid.PcdCryptoShaOptMask gPlatformCommonLibTokenSpaceGuid.PcdIppHashLibSupportedMask gPlatformCommonLibTokenSpaceGuid.PcdCompSignSchemeSupportedMask + gPlatformCommonLibTokenSpaceGuid.PcdCompSignHashAlg + gPlatformCommonLibTokenSpaceGuid.PcdCompSignType [BuildOptions] - MSFT:*_*_X64_CC_FLAGS = -D_ABL_ -D_L9 -D_ARCH_EM64T /GL- /arch:AVX2 + MSFT:*_*_X64_CC_FLAGS = -D_ABL_ -D_L9 -D_ARCH_EM64T -DIPPCP_FIPS_MODE -D_NO_IPP_DEPRECATED /GL- /arch:AVX2 MSFT:*_*_X64_NASM_FLAGS = -D_ABL_ -D_L9 -DWIN32E GCC:*_*_X64_NASM_FLAGS = -D_ABL_ -D_L9 -DLINUX32E - GCC:*_*_*_CC_FLAGS = -D_ABL_ -D_L9 -w -Wformat -Wformat-security -march=haswell -mavx2 -maes -mvaes -mpclmul -mvpclmulqdq -msha -mrdrnd -mrdseed + GCC:*_*_*_CC_FLAGS = -D_ABL_ -D_L9 -w -Wformat -Wformat-security -march=haswell -mavx2 -maes -mvaes -mpclmul -mvpclmulqdq -msha -mrdrnd -mrdseed -DIPPCP_FIPS_MODE -DMBX_FIPS_MODE -D_NO_IPP_DEPRECATED diff --git a/BootloaderCommonPkg/Library/IppCrypto2Lib/IppCrypto2LibM7.inf b/BootloaderCommonPkg/Library/IppCrypto2Lib/IppCrypto2LibM7.inf index 10a58592..4e4945d2 100644 --- a/BootloaderCommonPkg/Library/IppCrypto2Lib/IppCrypto2LibM7.inf +++ b/BootloaderCommonPkg/Library/IppCrypto2Lib/IppCrypto2LibM7.inf @@ -73,7 +73,7 @@ $(IPP_PATH)/sources/ippcp/pcprsa_initpublickey.c $(IPP_PATH)/sources/ippcp/pcprsa_setpublickey.c $(IPP_PATH)/sources/ippcp/pcprsa_sizeof_pubkey.h - $(IPP_PATH)/sources/ippcp/pcprsaverifyhash_pkcs1v15_rmf.c + $(IPP_PATH)/sources/ippcp/pcprsaverify_pkcs1v15_rmf.c $(IPP_PATH)/sources/ippcp/pcprsaverify_pss_rmf.c $(IPP_PATH)/sources/ippcp/pcprsa_gspub_cipher.c $(IPP_PATH)/sources/ippcp/gsmodmethod_rsa.c @@ -81,14 +81,16 @@ $(IPP_PATH)/sources/ippcp/pcprsa_gsmethod__gpr_public.c # Hash source files - $(IPP_PATH)/sources/ippcp/sm3/pcphashmethod_sm3.c - $(IPP_PATH)/sources/ippcp/sm3/pcphashsm3px.c - $(IPP_PATH)/sources/ippcp/pcphashmessage_rmf.c - $(IPP_PATH)/sources/ippcp/pcphashinit_rmf.c - $(IPP_PATH)/sources/ippcp/pcphashupdate_rmf.c - $(IPP_PATH)/sources/ippcp/pcphashfinal_rmf.c - $(IPP_PATH)/sources/ippcp/pcphashca_rmf.c - $(IPP_PATH)/sources/ippcp/sm3/pcpsm3stuff.h + $(IPP_PATH)/sources/ippcp/hash/sm3/pcphashmethod_sm3.c + $(IPP_PATH)/sources/ippcp/hash/sm3/pcphashsm3px.c + $(IPP_PATH)/sources/ippcp/hash/pcphashmessage_rmf.c + $(IPP_PATH)/sources/ippcp/hash/pcphashinit_rmf.c + $(IPP_PATH)/sources/ippcp/hash/pcphashupdate_rmf.c + $(IPP_PATH)/sources/ippcp/hash/pcphashfinal_rmf.c + $(IPP_PATH)/sources/ippcp/hash/pcphashca_rmf.c + $(IPP_PATH)/sources/ippcp/hash/sm3/pcpsm3stuff.h + $(IPP_PATH)/sources/ippcp/hash/sha512/pcpsha512stuff.h + $(IPP_PATH)/sources/ippcp/hash/sha256/pcpsha256stuff.h # HMAC source files $(IPP_PATH)/sources/ippcp/pcphmacmessage_rmf.c @@ -97,8 +99,67 @@ $(IPP_PATH)/sources/ippcp/pcphmacupdate_rmf.c $(IPP_PATH)/sources/ippcp/pcphmacfinal_rmf.c + # FIPS source files + fips.c + $(IPP_PATH)/include/ippcp/fips_cert.h + $(IPP_PATH)/sources/ippcp/fips_cert/common.c + $(IPP_PATH)/sources/ippcp/fips_cert/selftest_rsa_sign_verify_pkcs_v15.c + $(IPP_PATH)/sources/ippcp/pcprsaverify_pkcs1v15_rmf.c + $(IPP_PATH)/sources/ippcp/pcprsa_getbuffersizeprivatekey.c + $(IPP_PATH)/sources/ippcp/pcprsa_setprivatekeytype1.c + $(IPP_PATH)/sources/ippcp/pcprsa_initprivatekeytype1.c + $(IPP_PATH)/sources/ippcp/pcprsa_getsizeprivatekeytype1.c + $(IPP_PATH)/sources/ippcp/pcpbnsetwords.c + $(IPP_PATH)/sources/ippcp/pcprsasign_pkcs1v15_rmf.c + $(IPP_PATH)/sources/ippcp/hash/sha256/pcphashmethodset_sha256_tt.c + $(IPP_PATH)/sources/ippcp/pcprsa_gsmethod__gpr_private.c + $(IPP_PATH)/sources/ippcp/pcprsa_gsprv_cipher_crt.c + $(IPP_PATH)/sources/ippcp/pcprsa_gsprv_cipher.c + $(IPP_PATH)/sources/ippcp/pcpngmontexpstuff_win_sscm.c + $(IPP_PATH)/sources/ippcp/pcpngmontexpstuff_win.c + $(IPP_PATH)/sources/ippcp/gsscramble.c + $(IPP_PATH)/sources/ippcp/gsscramble_sscm.c + $(IPP_PATH)/sources/ippcp/fips_cert/selftest_hash_msg_upd_sha.c + $(IPP_PATH)/sources/ippcp/hash/sha512/pcphashmethodset_sha512.c + $(IPP_PATH)/sources/ippcp/hash/pcphashgetsize_rmf.c + $(IPP_PATH)/sources/ippcp/hash/pcphashgettag_rmf.c + $(IPP_PATH)/sources/ippcp/fips_cert/selftest_aes_upd_hmac.c + $(IPP_PATH)/sources/ippcp/pcphmacgettag_rmf.c + $(IPP_PATH)/sources/ippcp/pcphmacduplicate_rmf.c + $(IPP_PATH)/sources/ippcp/hash/pcphashcnt.c + $(IPP_PATH)/sources/ippcp/hash/pcphashduplicate_rmf.c + $(IPP_PATH)/sources/ippcp/fips_cert/selftest_rsa_sign_verify_pss.c + $(IPP_PATH)/sources/ippcp/cpinit.c + $(IPP_PATH)/sources/ippcp/pcprsasign_pss_rmf.c + $(IPP_PATH)/sources/ippcp/pcprsa_generatekeys.c + $(IPP_PATH)/sources/ippcp/pcprsa_initprivatekeytype2.c + $(IPP_PATH)/sources/ippcp/pcprsa_getsizeprivatekeytype2.c + $(IPP_PATH)/sources/ippcp/pcpprimeginitca.c + $(IPP_PATH)/sources/ippcp/pcpprimegetsize.c + $(IPP_PATH)/sources/ippcp/pcpprngenca.c + $(IPP_PATH)/sources/ippcp/pcpprnginitca.c + $(IPP_PATH)/sources/ippcp/pcpprnggetsize.c + $(IPP_PATH)/sources/ippcp/pcpprngen_range.c + $(IPP_PATH)/sources/ippcp/pcpprngen_pattern.c + $(IPP_PATH)/sources/ippcp/pcpprime_mimimaltest.c + $(IPP_PATH)/sources/ippcp/pcpbn_val3.c + $(IPP_PATH)/sources/ippcp/pcpbn_val1.c + $(IPP_PATH)/sources/ippcp/pcpbnu_lsr.c + $(IPP_PATH)/sources/ippcp/pcpbnu_ntz.c + $(IPP_PATH)/sources/ippcp/pcpbnu_arith_minv.c + $(IPP_PATH)/sources/ippcp/pcpbnarithgcd.c + $(IPP_PATH)/sources/ippcp/gsmodmethod_mont.c + $(IPP_PATH)/sources/ippcp/pcpprng_gen.c + $(IPP_PATH)/sources/ippcp/pcpbnu_arith_gcd.c + $(IPP_PATH)/sources/ippcp/pcpbnu32_arith_muldigit.c + $(IPP_PATH)/sources/ippcp/hash/pcphashmethodgetsize.c + [Sources.X64] $(IPP_PATH)/sources/ippcp/asm_ia32/pcpvariant_xmm7560.inc + # FIPS + $(IPP_PATH)/sources/ippcp/asm_intel64/pcpbnumaconem7as.nasm + $(IPP_PATH)/sources/ippcp/asm_intel64/cpinitas.nasm + $(IPP_PATH)/sources/ippcp/asm_intel64/pcpsha1m7as.nasm # m7 files $(IPP_PATH)/sources/ippcp/asm_intel64/pcpsha256m7as.nasm $(IPP_PATH)/sources/ippcp/asm_intel64/pcpsha512m7as.nasm @@ -123,6 +184,9 @@ $(IPP_PATH)/sources/ippcp/asm_intel64/pcpbnusqrschoolm7as.asm : $(IPP_PATH)/sources/ippcp/asm_intel64/pcpbnusqrschoolm7as.nasm $(IPP_PATH)/sources/ippcp/asm_intel64/pcpmontreductionm7as.asm : $(IPP_PATH)/sources/ippcp/asm_intel64/pcpmontreductionm7as.nasm $(IPP_PATH)/sources/ippcp/asm_intel64/pcppurgeblkm7as.asm : $(IPP_PATH)/sources/ippcp/asm_intel64/pcppurgeblkm7as.nasm + $(IPP_PATH)/sources/ippcp/asm_intel64/pcpbnumaconem7as.asm : $(IPP_PATH)/sources/ippcp/asm_intel64/pcpbnumaconem7as.nasm + $(IPP_PATH)/sources/ippcp/asm_intel64/cpinitas.asm : $(IPP_PATH)/sources/ippcp/asm_intel64/cpinitas.nasm + $(IPP_PATH)/sources/ippcp/asm_intel64/pcpsha1m7as.asm : $(IPP_PATH)/sources/ippcp/asm_intel64/pcpsha1m7as.nasm [Packages] @@ -138,10 +202,13 @@ gPlatformCommonLibTokenSpaceGuid.PcdCryptoShaOptMask gPlatformCommonLibTokenSpaceGuid.PcdIppHashLibSupportedMask gPlatformCommonLibTokenSpaceGuid.PcdCompSignSchemeSupportedMask + gPlatformCommonLibTokenSpaceGuid.PcdCompSignHashAlg + gPlatformCommonLibTokenSpaceGuid.PcdCompSignType + [BuildOptions] - MSFT:*_*_*_CC_FLAGS = -D_ABL_ -D_M7 /GL- + MSFT:*_*_*_CC_FLAGS = -D_ABL_ -D_M7 -DIPPCP_FIPS_MODE -D_ARCH_EM64T -D_NO_IPP_DEPRECATED /GL- MSFT:*_*_X64_NASM_FLAGS = -D_ABL_ -D_M7 -DWIN32E GCC:*_*_X64_NASM_FLAGS = -D_ABL_ -D_M7 -DLINUX32E - GCC:*_*_*_CC_FLAGS = -D_ABL_ -D_M7 -w -Wformat -Wformat-security -march=nocona -msse3 + GCC:*_*_*_CC_FLAGS = -D_ABL_ -D_M7 -w -Wformat -Wformat-security -march=nocona -msse3 -DIPPCP_FIPS_MODE -DMBX_FIPS_MODE -D_ARCH_EM64T -D_NO_IPP_DEPRECATED diff --git a/BootloaderCommonPkg/Library/IppCrypto2Lib/IppCrypto2LibU8.inf b/BootloaderCommonPkg/Library/IppCrypto2Lib/IppCrypto2LibU8.inf index 78953349..7c12f8a2 100644 --- a/BootloaderCommonPkg/Library/IppCrypto2Lib/IppCrypto2LibU8.inf +++ b/BootloaderCommonPkg/Library/IppCrypto2Lib/IppCrypto2LibU8.inf @@ -73,7 +73,7 @@ $(IPP_PATH)/sources/ippcp/pcprsa_initpublickey.c $(IPP_PATH)/sources/ippcp/pcprsa_setpublickey.c $(IPP_PATH)/sources/ippcp/pcprsa_sizeof_pubkey.h - $(IPP_PATH)/sources/ippcp/pcprsaverifyhash_pkcs1v15_rmf.c + $(IPP_PATH)/sources/ippcp/pcprsaverify_pkcs1v15_rmf.c $(IPP_PATH)/sources/ippcp/pcprsaverify_pss_rmf.c $(IPP_PATH)/sources/ippcp/pcprsa_gspub_cipher.c $(IPP_PATH)/sources/ippcp/gsmodmethod_rsa.c @@ -81,12 +81,14 @@ $(IPP_PATH)/sources/ippcp/pcprsa_gsmethod__gpr_public.c # Hash source files - $(IPP_PATH)/sources/ippcp/pcphashmessage_rmf.c - $(IPP_PATH)/sources/ippcp/pcphashinit_rmf.c - $(IPP_PATH)/sources/ippcp/pcphashupdate_rmf.c - $(IPP_PATH)/sources/ippcp/pcphashfinal_rmf.c - $(IPP_PATH)/sources/ippcp/pcphashca_rmf.c - $(IPP_PATH)/sources/ippcp/sm3/pcpsm3stuff.h + $(IPP_PATH)/sources/ippcp/hash/pcphashmessage_rmf.c + $(IPP_PATH)/sources/ippcp/hash/pcphashinit_rmf.c + $(IPP_PATH)/sources/ippcp/hash/pcphashupdate_rmf.c + $(IPP_PATH)/sources/ippcp/hash/pcphashfinal_rmf.c + $(IPP_PATH)/sources/ippcp/hash/pcphashca_rmf.c + $(IPP_PATH)/sources/ippcp/hash/sm3/pcpsm3stuff.h + $(IPP_PATH)/sources/ippcp/hash/sha256/pcpsha256stuff.h + $(IPP_PATH)/sources/ippcp/hash/sha512/pcpsha512stuff.h # HMAC source files $(IPP_PATH)/sources/ippcp/pcphmacmessage_rmf.c @@ -95,11 +97,70 @@ $(IPP_PATH)/sources/ippcp/pcphmacupdate_rmf.c $(IPP_PATH)/sources/ippcp/pcphmacfinal_rmf.c + # FIPS source files + fips.c + $(IPP_PATH)/include/ippcp/fips_cert.h + $(IPP_PATH)/sources/ippcp/fips_cert/common.c + $(IPP_PATH)/sources/ippcp/fips_cert/selftest_rsa_sign_verify_pkcs_v15.c + $(IPP_PATH)/sources/ippcp/pcprsaverify_pkcs1v15_rmf.c + $(IPP_PATH)/sources/ippcp/pcprsa_getbuffersizeprivatekey.c + $(IPP_PATH)/sources/ippcp/pcprsa_setprivatekeytype1.c + $(IPP_PATH)/sources/ippcp/pcprsa_initprivatekeytype1.c + $(IPP_PATH)/sources/ippcp/pcprsa_getsizeprivatekeytype1.c + $(IPP_PATH)/sources/ippcp/pcpbnsetwords.c + $(IPP_PATH)/sources/ippcp/pcprsasign_pkcs1v15_rmf.c + $(IPP_PATH)/sources/ippcp/hash/sha256/pcphashmethodset_sha256_tt.c + $(IPP_PATH)/sources/ippcp/pcprsa_gsmethod__gpr_private.c + $(IPP_PATH)/sources/ippcp/pcprsa_gsprv_cipher_crt.c + $(IPP_PATH)/sources/ippcp/pcprsa_gsprv_cipher.c + $(IPP_PATH)/sources/ippcp/pcpngmontexpstuff_win_sscm.c + $(IPP_PATH)/sources/ippcp/pcpngmontexpstuff_win.c + $(IPP_PATH)/sources/ippcp/gsscramble.c + $(IPP_PATH)/sources/ippcp/gsscramble_sscm.c + $(IPP_PATH)/sources/ippcp/fips_cert/selftest_hash_msg_upd_sha.c + $(IPP_PATH)/sources/ippcp/hash/sha512/pcphashmethodset_sha512.c + $(IPP_PATH)/sources/ippcp/hash/pcphashgetsize_rmf.c + $(IPP_PATH)/sources/ippcp/hash/pcphashgettag_rmf.c + $(IPP_PATH)/sources/ippcp/fips_cert/selftest_aes_upd_hmac.c + $(IPP_PATH)/sources/ippcp/pcphmacgettag_rmf.c + $(IPP_PATH)/sources/ippcp/pcphmacduplicate_rmf.c + $(IPP_PATH)/sources/ippcp/hash/pcphashcnt.c + $(IPP_PATH)/sources/ippcp/hash/pcphashduplicate_rmf.c + $(IPP_PATH)/sources/ippcp/fips_cert/selftest_rsa_sign_verify_pss.c + $(IPP_PATH)/sources/ippcp/cpinit.c + $(IPP_PATH)/sources/ippcp/pcprsasign_pss_rmf.c + $(IPP_PATH)/sources/ippcp/pcprsa_generatekeys.c + $(IPP_PATH)/sources/ippcp/pcprsa_initprivatekeytype2.c + $(IPP_PATH)/sources/ippcp/pcprsa_getsizeprivatekeytype2.c + $(IPP_PATH)/sources/ippcp/pcpprimeginitca.c + $(IPP_PATH)/sources/ippcp/pcpprimegetsize.c + $(IPP_PATH)/sources/ippcp/pcpprngenca.c + $(IPP_PATH)/sources/ippcp/pcpprnginitca.c + $(IPP_PATH)/sources/ippcp/pcpprnggetsize.c + $(IPP_PATH)/sources/ippcp/pcpprngen_range.c + $(IPP_PATH)/sources/ippcp/pcpprngen_pattern.c + $(IPP_PATH)/sources/ippcp/pcpprime_mimimaltest.c + $(IPP_PATH)/sources/ippcp/pcpbn_val3.c + $(IPP_PATH)/sources/ippcp/pcpbn_val1.c + $(IPP_PATH)/sources/ippcp/pcpbnu_lsr.c + $(IPP_PATH)/sources/ippcp/pcpbnu_ntz.c + $(IPP_PATH)/sources/ippcp/pcpbnu_arith_minv.c + $(IPP_PATH)/sources/ippcp/pcpbnarithgcd.c + $(IPP_PATH)/sources/ippcp/gsmodmethod_mont.c + $(IPP_PATH)/sources/ippcp/pcpprng_gen.c + $(IPP_PATH)/sources/ippcp/pcpbnu_arith_gcd.c + $(IPP_PATH)/sources/ippcp/pcpbnu32_arith_muldigit.c + $(IPP_PATH)/sources/ippcp/hash/pcphashmethodgetsize.c + [Sources.X64] $(IPP_PATH)/sources/ippcp/asm_ia32/pcpvariant_xmm7560.inc # U8 files $(IPP_PATH)/sources/ippcp/asm_intel64/pcpsha256u8as.nasm $(IPP_PATH)/sources/ippcp/asm_intel64/pcpsm3u8as.nasm + # FIPS + $(IPP_PATH)/sources/ippcp/asm_intel64/pcpsha1u8as.nasm + $(IPP_PATH)/sources/ippcp/asm_intel64/pcpbnumaconem7as.nasm + $(IPP_PATH)/sources/ippcp/asm_intel64/cpinitas.nasm # m7 files $(IPP_PATH)/sources/ippcp/asm_intel64/pcpsha512m7as.nasm $(IPP_PATH)/sources/ippcp/asm_intel64/pcpbnuaddm7as.nasm @@ -124,6 +185,9 @@ $(IPP_PATH)/sources/ippcp/asm_intel64/pcpbnusqrschoolm7as.asm : $(IPP_PATH)/sources/ippcp/asm_intel64/pcpbnusqrschoolm7as.nasm $(IPP_PATH)/sources/ippcp/asm_intel64/pcpmontreductionm7as.asm : $(IPP_PATH)/sources/ippcp/asm_intel64/pcpmontreductionm7as.nasm $(IPP_PATH)/sources/ippcp/asm_intel64/pcppurgeblkm7as.asm : $(IPP_PATH)/sources/ippcp/asm_intel64/pcppurgeblkm7as.nasm + $(IPP_PATH)/sources/ippcp/asm_intel64/pcpsha1u8as.asm : $(IPP_PATH)/sources/ippcp/asm_intel64/pcpsha1u8as.nasm + $(IPP_PATH)/sources/ippcp/asm_intel64/pcpbnumaconem7as.asm : $(IPP_PATH)/sources/ippcp/asm_intel64/pcpbnumaconem7as.nasm + $(IPP_PATH)/sources/ippcp/asm_intel64/cpinitas.asm : $(IPP_PATH)/sources/ippcp/asm_intel64/cpinitas.nasm [Packages] @@ -139,10 +203,12 @@ gPlatformCommonLibTokenSpaceGuid.PcdCryptoShaOptMask gPlatformCommonLibTokenSpaceGuid.PcdIppHashLibSupportedMask gPlatformCommonLibTokenSpaceGuid.PcdCompSignSchemeSupportedMask + gPlatformCommonLibTokenSpaceGuid.PcdCompSignHashAlg + gPlatformCommonLibTokenSpaceGuid.PcdCompSignType [BuildOptions] - MSFT:*_*_*_CC_FLAGS = -D_ABL_ -D_U8 /GL- + MSFT:*_*_*_CC_FLAGS = -D_ABL_ -D_U8 -DIPPCP_FIPS_MODE -D_ARCH_EM64T -D_NO_IPP_DEPRECATED /GL- MSFT:*_*_X64_NASM_FLAGS = -D_ABL_ -D_U8 -DWIN32E GCC:*_*_X64_NASM_FLAGS = -D_ABL_ -D_U8 -DLINUX32E - GCC:*_*_*_CC_FLAGS = -D_ABL_ -D_U8 -w -Wformat -Wformat-security + GCC:*_*_*_CC_FLAGS = -D_ABL_ -D_U8 -w -Wformat -Wformat-security -DIPPCP_FIPS_MODE -DMBX_FIPS_MODE -D_ARCH_EM64T -D_NO_IPP_DEPRECATED diff --git a/BootloaderCommonPkg/Library/IppCrypto2Lib/IppCrypto2LibY8.inf b/BootloaderCommonPkg/Library/IppCrypto2Lib/IppCrypto2LibY8.inf index bf76776c..10cac8a6 100644 --- a/BootloaderCommonPkg/Library/IppCrypto2Lib/IppCrypto2LibY8.inf +++ b/BootloaderCommonPkg/Library/IppCrypto2Lib/IppCrypto2LibY8.inf @@ -73,7 +73,6 @@ $(IPP_PATH)/sources/ippcp/pcprsa_initpublickey.c $(IPP_PATH)/sources/ippcp/pcprsa_setpublickey.c $(IPP_PATH)/sources/ippcp/pcprsa_sizeof_pubkey.h - $(IPP_PATH)/sources/ippcp/pcprsaverifyhash_pkcs1v15_rmf.c $(IPP_PATH)/sources/ippcp/pcprsaverify_pss_rmf.c $(IPP_PATH)/sources/ippcp/pcprsa_gspub_cipher.c $(IPP_PATH)/sources/ippcp/gsmodmethod_rsa.c @@ -81,12 +80,13 @@ $(IPP_PATH)/sources/ippcp/pcprsa_gsmethod__gpr_public.c # Hash source files - $(IPP_PATH)/sources/ippcp/pcphashmessage_rmf.c - $(IPP_PATH)/sources/ippcp/pcphashinit_rmf.c - $(IPP_PATH)/sources/ippcp/pcphashupdate_rmf.c - $(IPP_PATH)/sources/ippcp/pcphashfinal_rmf.c - $(IPP_PATH)/sources/ippcp/pcphashca_rmf.c - $(IPP_PATH)/sources/ippcp/sm3/pcpsm3stuff.h + $(IPP_PATH)/sources/ippcp/hash/pcphashmessage_rmf.c + $(IPP_PATH)/sources/ippcp/hash/pcphashinit_rmf.c + $(IPP_PATH)/sources/ippcp/hash/pcphashupdate_rmf.c + $(IPP_PATH)/sources/ippcp/hash/pcphashfinal_rmf.c + $(IPP_PATH)/sources/ippcp/hash/pcphashca_rmf.c + $(IPP_PATH)/sources/ippcp/hash/sm3/pcpsm3stuff.h + $(IPP_PATH)/sources/ippcp/hash/sha512/pcpsha512stuff.h # HMAC source files $(IPP_PATH)/sources/ippcp/pcphmacmessage_rmf.c @@ -95,12 +95,73 @@ $(IPP_PATH)/sources/ippcp/pcphmacupdate_rmf.c $(IPP_PATH)/sources/ippcp/pcphmacfinal_rmf.c + # FIPS source files + fips.c + $(IPP_PATH)/include/ippcp/fips_cert.h + $(IPP_PATH)/sources/ippcp/fips_cert/common.c + $(IPP_PATH)/sources/ippcp/fips_cert/selftest_rsa_sign_verify_pkcs_v15.c + $(IPP_PATH)/sources/ippcp/pcprsaverify_pkcs1v15_rmf.c + $(IPP_PATH)/sources/ippcp/pcprsa_getbuffersizeprivatekey.c + $(IPP_PATH)/sources/ippcp/pcprsa_setprivatekeytype1.c + $(IPP_PATH)/sources/ippcp/pcprsa_initprivatekeytype1.c + $(IPP_PATH)/sources/ippcp/pcprsa_getsizeprivatekeytype1.c + $(IPP_PATH)/sources/ippcp/pcpbnsetwords.c + $(IPP_PATH)/sources/ippcp/pcprsasign_pkcs1v15_rmf.c + $(IPP_PATH)/sources/ippcp/hash/sha256/pcphashmethodset_sha256_tt.c + $(IPP_PATH)/sources/ippcp/pcprsa_gsmethod__gpr_private.c + $(IPP_PATH)/sources/ippcp/pcprsa_gsprv_cipher_crt.c + $(IPP_PATH)/sources/ippcp/pcprsa_gsprv_cipher.c + $(IPP_PATH)/sources/ippcp/pcpngmontexpstuff_win_sscm.c + $(IPP_PATH)/sources/ippcp/pcpngmontexpstuff_win.c + $(IPP_PATH)/sources/ippcp/gsscramble.c + $(IPP_PATH)/sources/ippcp/gsscramble_sscm.c + $(IPP_PATH)/sources/ippcp/fips_cert/selftest_hash_msg_upd_sha.c + $(IPP_PATH)/sources/ippcp/hash/sha512/pcphashmethodset_sha512.c + $(IPP_PATH)/sources/ippcp/hash/pcphashgetsize_rmf.c + $(IPP_PATH)/sources/ippcp/hash/pcphashgettag_rmf.c + $(IPP_PATH)/sources/ippcp/fips_cert/selftest_aes_upd_hmac.c + $(IPP_PATH)/sources/ippcp/pcphmacgettag_rmf.c + $(IPP_PATH)/sources/ippcp/pcphmacduplicate_rmf.c + $(IPP_PATH)/sources/ippcp/hash/pcphashcnt.c + $(IPP_PATH)/sources/ippcp/hash/pcphashduplicate_rmf.c + $(IPP_PATH)/sources/ippcp/fips_cert/selftest_rsa_sign_verify_pss.c + $(IPP_PATH)/sources/ippcp/cpinit.c + $(IPP_PATH)/sources/ippcp/pcprsasign_pss_rmf.c + $(IPP_PATH)/sources/ippcp/pcprsa_generatekeys.c + $(IPP_PATH)/sources/ippcp/pcprsa_initprivatekeytype2.c + $(IPP_PATH)/sources/ippcp/pcprsa_getsizeprivatekeytype2.c + $(IPP_PATH)/sources/ippcp/pcpprimeginitca.c + $(IPP_PATH)/sources/ippcp/pcpprimegetsize.c + $(IPP_PATH)/sources/ippcp/pcpprngenca.c + $(IPP_PATH)/sources/ippcp/pcpprnginitca.c + $(IPP_PATH)/sources/ippcp/pcpprnggetsize.c + $(IPP_PATH)/sources/ippcp/pcpprngen_range.c + $(IPP_PATH)/sources/ippcp/pcpprngen_pattern.c + $(IPP_PATH)/sources/ippcp/pcpprime_mimimaltest.c + $(IPP_PATH)/sources/ippcp/pcpbn_val3.c + $(IPP_PATH)/sources/ippcp/pcpbn_val1.c + $(IPP_PATH)/sources/ippcp/pcpbnu_lsr.c + $(IPP_PATH)/sources/ippcp/pcpbnu_ntz.c + $(IPP_PATH)/sources/ippcp/pcpbnu_arith_minv.c + $(IPP_PATH)/sources/ippcp/pcpbnarithgcd.c + $(IPP_PATH)/sources/ippcp/gsmodmethod_mont.c + $(IPP_PATH)/sources/ippcp/pcpprng_gen.c + $(IPP_PATH)/sources/ippcp/pcpbnu_arith_gcd.c + $(IPP_PATH)/sources/ippcp/pcpbnu32_arith_muldigit.c + $(IPP_PATH)/sources/ippcp/hash/pcphashmethodgetsize.c + [Sources.X64] $(IPP_PATH)/sources/ippcp/asm_ia32/pcpvariant_xmm7560.inc # NI files $(IPP_PATH)/sources/ippcp/asm_intel64/pcpsha256nias.nasm # U8 files $(IPP_PATH)/sources/ippcp/asm_intel64/pcpsm3u8as.nasm + # FIPS + $(IPP_PATH)/sources/ippcp/asm_intel64/pcpsha256u8as.nasm + $(IPP_PATH)/sources/ippcp/asm_intel64/pcpsha1u8as.nasm + $(IPP_PATH)/sources/ippcp/asm_intel64/pcpbnumaconem7as.nasm + $(IPP_PATH)/sources/ippcp/asm_intel64/pcpsha1nias.nasm + $(IPP_PATH)/sources/ippcp/asm_intel64/cpinitas.nasm # m7 files $(IPP_PATH)/sources/ippcp/asm_intel64/pcpsha512m7as.nasm $(IPP_PATH)/sources/ippcp/asm_intel64/pcpbnuaddm7as.nasm @@ -125,7 +186,11 @@ $(IPP_PATH)/sources/ippcp/asm_intel64/pcpbnusqrschoolm7as.asm : $(IPP_PATH)/sources/ippcp/asm_intel64/pcpbnusqrschoolm7as.nasm $(IPP_PATH)/sources/ippcp/asm_intel64/pcpmontreductionm7as.asm : $(IPP_PATH)/sources/ippcp/asm_intel64/pcpmontreductionm7as.nasm $(IPP_PATH)/sources/ippcp/asm_intel64/pcppurgeblkm7as.asm : $(IPP_PATH)/sources/ippcp/asm_intel64/pcppurgeblkm7as.nasm - + $(IPP_PATH)/sources/ippcp/asm_intel64/pcpsha256u8as.asm : $(IPP_PATH)/sources/ippcp/asm_intel64/pcpsha256u8as.nasm + $(IPP_PATH)/sources/ippcp/asm_intel64/pcpsha1u8as.asm : $(IPP_PATH)/sources/ippcp/asm_intel64/pcpsha1u8as.nasm + $(IPP_PATH)/sources/ippcp/asm_intel64/pcpbnumaconem7as.asm : $(IPP_PATH)/sources/ippcp/asm_intel64/pcpbnumaconem7as.nasm + $(IPP_PATH)/sources/ippcp/asm_intel64/pcpsha1nias.asm : $(IPP_PATH)/sources/ippcp/asm_intel64/pcpsha1nias.nasm + $(IPP_PATH)/sources/ippcp/asm_intel64/cpinitas.asm : $(IPP_PATH)/sources/ippcp/asm_intel64/cpinitas.nasm [Packages] MdePkg/MdePkg.dec @@ -140,10 +205,12 @@ gPlatformCommonLibTokenSpaceGuid.PcdCryptoShaOptMask gPlatformCommonLibTokenSpaceGuid.PcdIppHashLibSupportedMask gPlatformCommonLibTokenSpaceGuid.PcdCompSignSchemeSupportedMask + gPlatformCommonLibTokenSpaceGuid.PcdCompSignHashAlg + gPlatformCommonLibTokenSpaceGuid.PcdCompSignType [BuildOptions] - MSFT:*_*_*_CC_FLAGS = -D_ABL_ -D_Y8 /GL- + MSFT:*_*_*_CC_FLAGS = -D_ABL_ -D_Y8 -DIPPCP_FIPS_MODE -D_ARCH_EM64T -D_NO_IPP_DEPRECATED /GL- MSFT:*_*_X64_NASM_FLAGS = -D_ABL_ -D_Y8 -DWIN32E GCC:*_*_X64_NASM_FLAGS = -D_ABL_ -D_Y8 -DLINUX32E - GCC:*_*_*_CC_FLAGS = -D_ABL_ -D_Y8 -w -Wformat -Wformat-security -march=nehalem -msse4.2 -maes -mpclmul -msha -U__INTEL_COMPILER + GCC:*_*_*_CC_FLAGS = -D_ABL_ -D_Y8 -DIPPCP_FIPS_MODE -DMBX_FIPS_MODE -D_ARCH_EM64T -D_NO_IPP_DEPRECATED -w -Wformat -Wformat-security -march=nehalem -msse4.2 -maes -mpclmul -msha -U__INTEL_COMPILER diff --git a/BootloaderCommonPkg/Library/IppCrypto2Lib/fips.c b/BootloaderCommonPkg/Library/IppCrypto2Lib/fips.c new file mode 100644 index 00000000..f2893256 --- /dev/null +++ b/BootloaderCommonPkg/Library/IppCrypto2Lib/fips.c @@ -0,0 +1,411 @@ +/** @file + + Copyright (c) 2025, Intel Corporation. All rights reserved.
+ SPDX-License-Identifier: BSD-2-Clause-Patent + +**/ +#include "owndefs.h" +#include "owncp.h" + +#include "pcpngrsa.h" +#include "pcphash.h" +#include "pcptool.h" +#include "ippcp/fips_cert.h" + +#include +#include +#include + + +RETURN_STATUS +EFIAPI +IppCrypto2LibFipsSelftestRsaVerifyPkcsv15 () +{ + DEBUG ((DEBUG_INFO, "FipsSelftestRsaVerifyPkcsv15\n")); + //------ FIPS-required part + // 1. check that the function is FIPS-approved: + if(!ippcp_is_fips_approved_func(RSAVerify_PKCS1v15_rmf)) { + return RETURN_UNSUPPORTED; // cannot use this function in FIPS mode. + } + + // 2. Run the Selftest + fips_test_status selftest_status = IPPCP_ALGO_SELFTEST_OK; + + // Query buffer size for the test and allocate it (it can be done on Intel® Cryptography Primitives Library side with IPPCP_SELFTEST_USE_MALLOC=on) + int KeysBufferSize = 0; + selftest_status += fips_selftest_ippsRSASignVerify_PKCS1v15_rmf_get_size_keys(&KeysBufferSize); + + Ipp8u *pKeysBuffer = AllocateTemporaryMemory(KeysBufferSize); + if (pKeysBuffer == NULL) { + return RETURN_OUT_OF_RESOURCES; + } + int BufferSize = 0; + selftest_status += fips_selftest_ippsRSASignVerify_PKCS1v15_rmf_get_size(&BufferSize, pKeysBuffer); + + Ipp8u *pBuffer = AllocateTemporaryMemory(BufferSize); + if (pBuffer == NULL) { + FreeTemporaryMemory(pKeysBuffer); + return RETURN_OUT_OF_RESOURCES; + } + + // Run the test + selftest_status += fips_selftest_ippsRSAVerify_PKCS1v15_rmf(pBuffer, pKeysBuffer); + + // Check selftest status + if (IPPCP_ALGO_SELFTEST_OK != selftest_status) { + return RETURN_UNSUPPORTED; // selftest is not successful -> cannot use this function in FIPS mode. + } + //------ FIPS-required part ends (only needed before the first use of algorithm) + + FreeTemporaryMemory(pKeysBuffer); + FreeTemporaryMemory(pBuffer); + return RETURN_SUCCESS; +} + +RETURN_STATUS +EFIAPI +IppCrypto2LibFipsSelftestSHA256 () +{ + DEBUG ((DEBUG_INFO, "FipsSelftestSHA256\n")); + // 1. check that the function is FIPS-approved: + if(!ippcp_is_fips_approved_func(HashMessage_rmf)) { + return RETURN_UNSUPPORTED; // cannot use this function in FIPS mode. + } + + // 2. Run the Selftest + fips_test_status selftest_status = IPPCP_ALGO_SELFTEST_OK; + + // Query buffer size for the test and allocate it (it can be done on Intel® Cryptography Primitives Library side with IPPCP_SELFTEST_USE_MALLOC=on) + selftest_status += fips_selftest_ippsHashMessage_rmf(ippHashAlg_SHA256); + + // Check selftest status + if (IPPCP_ALGO_SELFTEST_OK != selftest_status) { + return RETURN_UNSUPPORTED; // selftest is not successful -> cannot use this function in FIPS mode. + } + //------ FIPS-required part ends (only needed before the first use of algorithm) + + return RETURN_SUCCESS; +} + +RETURN_STATUS +EFIAPI +IppCrypto2LibFipsSelftestSHA384 () +{ + DEBUG ((DEBUG_INFO, "FipsSelftestSHA384\n")); + // 1. check that the function is FIPS-approved: + if(!ippcp_is_fips_approved_func(HashMessage_rmf)) { + return RETURN_UNSUPPORTED; // cannot use this function in FIPS mode. + } + + // 2. Run the Selftest + fips_test_status selftest_status = IPPCP_ALGO_SELFTEST_OK; + + // Query buffer size for the test and allocate it (it can be done on Intel® Cryptography Primitives Library side with IPPCP_SELFTEST_USE_MALLOC=on) + selftest_status += fips_selftest_ippsHashMessage_rmf(ippHashAlg_SHA384); + + // Check selftest status + if (IPPCP_ALGO_SELFTEST_OK != selftest_status) { + return RETURN_UNSUPPORTED; // selftest is not successful -> cannot use this function in FIPS mode. + } + //------ FIPS-required part ends (only needed before the first use of algorithm) + + return RETURN_SUCCESS; +} + +/* SM3 is not supported by FIPS +RETURN_STATUS +EFIAPI +IppCrypto2LibFipsSelftestSM3 () +{ + // 1. check that the function is FIPS-approved: + if(!ippcp_is_fips_approved_func(HashMessage_rmf)) { + return RETURN_UNSUPPORTED; // cannot use this function in FIPS mode. + } + + // 2. Run the Selftest + fips_test_status selftest_status = IPPCP_ALGO_SELFTEST_OK; + + // Query buffer size for the test and allocate it (it can be done on Intel® Cryptography Primitives Library side with IPPCP_SELFTEST_USE_MALLOC=on) + selftest_status += fips_selftest_ippsHashMessage_rmf(ippHashAlg_SM3); + + // Check selftest status + if (IPPCP_ALGO_SELFTEST_OK != selftest_status) { + return RETURN_UNSUPPORTED; // selftest is not successful -> cannot use this function in FIPS mode. + } + //------ FIPS-required part ends (only needed before the first use of algorithm) + + return RETURN_SUCCESS; +} + +RETURN_STATUS +EFIAPI +IppCrypto2LibFipsSelftestSM3Update () +{ + //------ FIPS-required part + // 1. check that the function is FIPS-approved: + if(!ippcp_is_fips_approved_func(HashUpdate_rmf)) { + return RETURN_UNSUPPORTED; // cannot use this function in FIPS mode. + } + + // 2. Run the Selftest + fips_test_status selftest_status = IPPCP_ALGO_SELFTEST_OK; + + // Query buffer size for the test and allocate it (it can be done on Intel® Cryptography Primitives Library side with IPPCP_SELFTEST_USE_MALLOC=on) + int BufferSize = 0; + selftest_status += fips_selftest_ippsHash_rmf_get_size(&BufferSize); + + Ipp8u *pBuffer = AllocateTemporaryMemory(BufferSize); + if (pBuffer == NULL) { + return RETURN_OUT_OF_RESOURCES; + } + + // Run the test + selftest_status += fips_selftest_ippsHashUpdate_rmf(ippHashAlg_SM3, pBuffer); + + // Check selftest status + if (IPPCP_ALGO_SELFTEST_OK != selftest_status) { + return RETURN_UNSUPPORTED; // selftest is not successful -> cannot use this function in FIPS mode. + } + //------ FIPS-required part ends (only needed before the first use of algorithm) + + FreeTemporaryMemory(pBuffer); + return RETURN_SUCCESS; +} +*/ + +RETURN_STATUS +EFIAPI +IppCrypto2LibFipsSelftestSHA256Update () +{ + DEBUG ((DEBUG_INFO, "FipsSelftestSHA256Update\n")); + //------ FIPS-required part + // 1. check that the function is FIPS-approved: + if(!ippcp_is_fips_approved_func(HashUpdate_rmf)) { + return RETURN_UNSUPPORTED; // cannot use this function in FIPS mode. + } + + // 2. Run the Selftest + fips_test_status selftest_status = IPPCP_ALGO_SELFTEST_OK; + + // Query buffer size for the test and allocate it (it can be done on Intel® Cryptography Primitives Library side with IPPCP_SELFTEST_USE_MALLOC=on) + int BufferSize = 0; + selftest_status += fips_selftest_ippsHash_rmf_get_size(&BufferSize); + + Ipp8u *pBuffer = AllocateTemporaryMemory(BufferSize); + if (pBuffer == NULL) { + return RETURN_OUT_OF_RESOURCES; + } + + // Run the test + selftest_status += fips_selftest_ippsHashUpdate_rmf(ippHashAlg_SHA256, pBuffer); + + // Check selftest status + if (IPPCP_ALGO_SELFTEST_OK != selftest_status) { + return RETURN_UNSUPPORTED; // selftest is not successful -> cannot use this function in FIPS mode. + } + //------ FIPS-required part ends (only needed before the first use of algorithm) + + FreeTemporaryMemory(pBuffer); + return RETURN_SUCCESS; +} + +RETURN_STATUS +EFIAPI +IppCrypto2LibFipsSelftestSHA384Update () +{ + DEBUG ((DEBUG_INFO, "FipsSelftestSHA384Update\n")); + //------ FIPS-required part + // 1. check that the function is FIPS-approved: + if(!ippcp_is_fips_approved_func(HashUpdate_rmf)) { + return RETURN_UNSUPPORTED; // cannot use this function in FIPS mode. + } + + // 2. Run the Selftest + fips_test_status selftest_status = IPPCP_ALGO_SELFTEST_OK; + + // Query buffer size for the test and allocate it (it can be done on Intel® Cryptography Primitives Library side with IPPCP_SELFTEST_USE_MALLOC=on) + int BufferSize = 0; + selftest_status += fips_selftest_ippsHash_rmf_get_size(&BufferSize); + + Ipp8u *pBuffer = AllocateTemporaryMemory(BufferSize); + if (pBuffer == NULL) { + return RETURN_OUT_OF_RESOURCES; + } + + // Run the test + selftest_status += fips_selftest_ippsHashUpdate_rmf(ippHashAlg_SHA384, pBuffer); + + // Check selftest status + if (IPPCP_ALGO_SELFTEST_OK != selftest_status) { + return RETURN_UNSUPPORTED; // selftest is not successful -> cannot use this function in FIPS mode. + } + //------ FIPS-required part ends (only needed before the first use of algorithm) + + FreeTemporaryMemory(pBuffer); + return RETURN_SUCCESS; +} + +#if 0 +RETURN_STATUS +EFIAPI +IppCrypto2LibFipsSelftestHMAC () +{ + // 1. check that the function is FIPS-approved: + if(!ippcp_is_fips_approved_func(HMACMessage_rmf)) { + return RETURN_UNSUPPORTED; // cannot use this function in FIPS mode. + } + + // 2. Run the Selftest + fips_test_status selftest_status = IPPCP_ALGO_SELFTEST_OK; + + // Query buffer size for the test and allocate it (it can be done on Intel® Cryptography Primitives Library side with IPPCP_SELFTEST_USE_MALLOC=on) + selftest_status += fips_selftest_ippsHMACMessage_rmf(); + + // Check selftest status + if (IPPCP_ALGO_SELFTEST_OK != selftest_status) { + return RETURN_UNSUPPORTED; // selftest is not successful -> cannot use this function in FIPS mode. + } + //------ FIPS-required part ends (only needed before the first use of algorithm) + + return RETURN_SUCCESS; +} + +RETURN_STATUS +EFIAPI +IppCrypto2LibFipsSelftestHMACUpdate () +{ + //------ FIPS-required part + // 1. check that the function is FIPS-approved: + if(!ippcp_is_fips_approved_func(HMACUpdate_rmf)) { + return RETURN_UNSUPPORTED; // cannot use this function in FIPS mode. + } + + // 2. Run the Selftest + fips_test_status selftest_status = IPPCP_ALGO_SELFTEST_OK; + + // Query buffer size for the test and allocate it (it can be done on Intel® Cryptography Primitives Library side with IPPCP_SELFTEST_USE_MALLOC=on) + int BufferSize = 0; + selftest_status += fips_selftest_ippsHMAC_rmf_get_size(&BufferSize); + + Ipp8u *pBuffer = AllocateTemporaryMemory(BufferSize); + if (pBuffer == NULL) { + return RETURN_OUT_OF_RESOURCES; + } + + // Run the test + selftest_status += fips_selftest_ippsHMACUpdate_rmf(pBuffer); + + // Check selftest status + if (IPPCP_ALGO_SELFTEST_OK != selftest_status) { + return RETURN_UNSUPPORTED; // selftest is not successful -> cannot use this function in FIPS mode. + } + //------ FIPS-required part ends (only needed before the first use of algorithm) + + FreeTemporaryMemory(pBuffer); + return RETURN_SUCCESS; +} +#endif + +RETURN_STATUS +EFIAPI +IppCrypto2LibFipsSelftestRsaVerifyPSS () +{ + DEBUG ((DEBUG_INFO, "FipsSelftestRsaVerifyPSS\n")); + //------ FIPS-required part + // 1. check that the function is FIPS-approved: + if(!ippcp_is_fips_approved_func(RSAVerify_PSS_rmf)) { + return RETURN_UNSUPPORTED; // cannot use this function in FIPS mode. + } + + // 2. Run the Selftest + fips_test_status selftest_status = IPPCP_ALGO_SELFTEST_OK; + + // Query buffer size for the test and allocate it (it can be done on Intel® Cryptography Primitives Library side with IPPCP_SELFTEST_USE_MALLOC=on) + int KeysBufferSize = 0; + selftest_status += fips_selftest_ippsRSASignVerify_PSS_rmf_get_size_keys(&KeysBufferSize); + + Ipp8u *pKeysBuffer = AllocateTemporaryMemory(KeysBufferSize); + if (pKeysBuffer == NULL) { + return RETURN_OUT_OF_RESOURCES; + } + + int BufferSize = 0; + selftest_status += fips_selftest_ippsRSASignVerify_PSS_rmf_get_size(&BufferSize, pKeysBuffer); + + Ipp8u *pBuffer = AllocateTemporaryMemory(BufferSize); + if (pBuffer == NULL) { + FreeTemporaryMemory(pKeysBuffer); + return RETURN_OUT_OF_RESOURCES; + } + + // Run the test + selftest_status += fips_selftest_ippsRSAVerify_PSS_rmf(pBuffer, pKeysBuffer); + + // Check selftest status + if (IPPCP_ALGO_SELFTEST_OK != selftest_status) { + return RETURN_UNSUPPORTED; // selftest is not successful -> cannot use this function in FIPS mode. + } + //------ FIPS-required part ends (only needed before the first use of algorithm) + + FreeTemporaryMemory(pKeysBuffer); + FreeTemporaryMemory(pBuffer); + return RETURN_SUCCESS; +} + +RETURN_STATUS +EFIAPI +RunFipsSelftests () +{ + DEBUG ((DEBUG_INFO, "Running FIPS selftests\n")); + // Run the selftests for SHA256 + if(FixedPcdGet8(PcdCompSignHashAlg) == HASH_TYPE_SHA256) { + if (EFI_ERROR(IppCrypto2LibFipsSelftestSHA256())) { + return RETURN_UNSUPPORTED; + } + if (EFI_ERROR(IppCrypto2LibFipsSelftestSHA256Update())) { + return RETURN_UNSUPPORTED; + } + } + + // Run the selftests for SHA384 + if(FixedPcdGet8(PcdCompSignHashAlg) == HASH_TYPE_SHA384) { + if (EFI_ERROR(IppCrypto2LibFipsSelftestSHA384())) { + return RETURN_UNSUPPORTED; + } + if (EFI_ERROR(IppCrypto2LibFipsSelftestSHA384Update())) { + return RETURN_UNSUPPORTED; + } + } +/* SM3 is not supported by FIPS + // Run the selftests for SM3 + if (EFI_ERROR(IppCrypto2LibFipsSelftestSM3())) { + //return RETURN_UNSUPPORTED; + } + if (EFI_ERROR(IppCrypto2LibFipsSelftestSM3Update())) { + //return RETURN_UNSUPPORTED; + } +*/ +/* HMAC is not being used yet + // Run the selftests for HMAC + if (EFI_ERROR(IppCrypto2LibFipsSelftestHMAC())) { + return RETURN_UNSUPPORTED; + } + if (EFI_ERROR(IppCrypto2LibFipsSelftestHMACUpdate())) { + return RETURN_UNSUPPORTED; + } +*/ + // Run the selftests for RSA PKCSv15 Verify + if ((FixedPcdGet8(PcdCompSignType) & IPP_RSALIB_PKCS_1_5) != 0) { + if (EFI_ERROR(IppCrypto2LibFipsSelftestRsaVerifyPkcsv15())) { + return RETURN_UNSUPPORTED; + } + } + + // Run the selftests for RSA PSS Verify + if ((FixedPcdGet8(PcdCompSignType) & IPP_RSALIB_PSS) != 0) { + if (EFI_ERROR(IppCrypto2LibFipsSelftestRsaVerifyPSS())) { + return RETURN_UNSUPPORTED; + } + } + return RETURN_SUCCESS; +} \ No newline at end of file diff --git a/BootloaderCommonPkg/Library/IppCrypto2Lib/ipp-crypto b/BootloaderCommonPkg/Library/IppCrypto2Lib/ipp-crypto index f79ed30c..3b6588d4 160000 --- a/BootloaderCommonPkg/Library/IppCrypto2Lib/ipp-crypto +++ b/BootloaderCommonPkg/Library/IppCrypto2Lib/ipp-crypto @@ -1 +1 @@ -Subproject commit f79ed30c0fc5cf874a5e1bc3d1dd8d7262132a89 +Subproject commit 3b6588d4f1ef5667ea6a49d1c349a66f0002b55f diff --git a/BootloaderCommonPkg/Library/IppCrypto2Lib/rsa_verify.c b/BootloaderCommonPkg/Library/IppCrypto2Lib/rsa_verify.c index ebb68071..9000f5e7 100644 --- a/BootloaderCommonPkg/Library/IppCrypto2Lib/rsa_verify.c +++ b/BootloaderCommonPkg/Library/IppCrypto2Lib/rsa_verify.c @@ -28,7 +28,7 @@ IPPAPI( const IppsHashMethod*, ippsHashMethod_SHA256Sbl, (void) ) /* Wrapper function for RSA PKCS_1.5 Verify to make the inferface consistent. * Returns non-zero on failure, 0 on success. */ -int VerifyRsaPkcs1Signature (CONST PUB_KEY_HDR *PubKeyHdr, CONST SIGNATURE_HDR *SignatureHdr, CONST UINT8 *Hash) +int VerifyRsaPkcs1Signature (CONST PUB_KEY_HDR *PubKeyHdr, CONST SIGNATURE_HDR *SignatureHdr, CONST UINT8 *Src, CONST UINT32 Size) { int sz_n; int sz_e; @@ -136,7 +136,7 @@ int VerifyRsaPkcs1Signature (CONST PUB_KEY_HDR *PubKeyHdr, CONST SIGNATURE_HDR * } if (pHashMethod != NULL) { - err = ippsRSAVerifyHash_PKCS1v15_rmf((const Ipp8u *)Hash, (Ipp8u *)SignatureHdr->Signature, &signature_verified, rsa_key_s, pHashMethod, scratch_buf); + err = ippsRSAVerify_PKCS1v15_rmf ((const Ipp8u *)Src, Size, (Ipp8u *)SignatureHdr->Signature, &signature_verified, rsa_key_s, pHashMethod, scratch_buf); } else { err = ippStsNoOperation; } @@ -292,7 +292,7 @@ int VerifyRsaPssSignature (CONST PUB_KEY_HDR *PubKeyHdr, CONST SIGNATURE_HDR *Si */ RETURN_STATUS EFIAPI -RsaVerify_Pkcs_1_5 (CONST PUB_KEY_HDR *PubKeyHdr, CONST SIGNATURE_HDR *SignatureHdr, CONST UINT8 *Hash) +RsaVerify2_Pkcs_1_5 (CONST PUB_KEY_HDR *PubKeyHdr, CONST SIGNATURE_HDR *SignatureHdr, CONST UINT8 *Src, CONST UINT32 SrcSize) { if (FixedPcdGet8(PcdCompSignSchemeSupportedMask) & IPP_RSALIB_PKCS_1_5) { @@ -300,7 +300,7 @@ RsaVerify_Pkcs_1_5 (CONST PUB_KEY_HDR *PubKeyHdr, CONST SIGNATURE_HDR *Signature ((SignatureHdr->SigSize != RSA2048_MOD_SIZE) && (SignatureHdr->SigSize != RSA3072_MOD_SIZE))) { return RETURN_INVALID_PARAMETER; } else { - return VerifyRsaPkcs1Signature (PubKeyHdr, SignatureHdr, Hash) ? RETURN_SECURITY_VIOLATION : RETURN_SUCCESS ; + return VerifyRsaPkcs1Signature (PubKeyHdr, SignatureHdr, Src, SrcSize) ? RETURN_SECURITY_VIOLATION : RETURN_SUCCESS ; } } else { return RETURN_UNSUPPORTED; diff --git a/BootloaderCommonPkg/Library/LoaderPerformanceLib/LoaderPerformancePrintLib.c b/BootloaderCommonPkg/Library/LoaderPerformanceLib/LoaderPerformancePrintLib.c index d80b8c56..b2609527 100644 --- a/BootloaderCommonPkg/Library/LoaderPerformanceLib/LoaderPerformancePrintLib.c +++ b/BootloaderCommonPkg/Library/LoaderPerformanceLib/LoaderPerformancePrintLib.c @@ -139,6 +139,8 @@ DefPerfIdToStr ( return "FSP EndOfFirmware notify"; case 0x31F0: return "End of stage2"; + case 0x10D0: + return "FIPS Selftest run"; } return NULL; } diff --git a/BootloaderCommonPkg/Library/SecureBootLib/SecureBootLib.inf b/BootloaderCommonPkg/Library/SecureBootLib/SecureBootLib.inf index c013fddf..0bad0a54 100644 --- a/BootloaderCommonPkg/Library/SecureBootLib/SecureBootLib.inf +++ b/BootloaderCommonPkg/Library/SecureBootLib/SecureBootLib.inf @@ -40,3 +40,6 @@ BootloaderCommonLib BootloaderLib RngLib + +[FixedPcd] + gPlatformCommonLibTokenSpaceGuid.PcdIppcrypto2Lib diff --git a/BootloaderCommonPkg/Library/SecureBootLib/SecureBootRsa.c b/BootloaderCommonPkg/Library/SecureBootLib/SecureBootRsa.c index af98d48d..876a07e5 100644 --- a/BootloaderCommonPkg/Library/SecureBootLib/SecureBootRsa.c +++ b/BootloaderCommonPkg/Library/SecureBootLib/SecureBootRsa.c @@ -86,7 +86,12 @@ DoRsaVerify ( CopyMem (OutHash, Digest, DigestSize); } +#if FixedPcdGetBool(PcdIppcrypto2Lib) + // RSA Pkcs 1.5 requires to pass message to be verified + Status = RsaVerify2_Pkcs_1_5 (PublicKey, SignatureHdr, Data, Length); +#else Status = RsaVerify_Pkcs_1_5 (PublicKey, SignatureHdr, Digest); +#endif } else if(SignatureHdr->SigType == SIGNING_TYPE_RSA_PSS) { diff --git a/BootloaderCorePkg/BootloaderCorePkg.dsc b/BootloaderCorePkg/BootloaderCorePkg.dsc index 7c47b15f..046f615a 100644 --- a/BootloaderCorePkg/BootloaderCorePkg.dsc +++ b/BootloaderCorePkg/BootloaderCorePkg.dsc @@ -496,3 +496,5 @@ # VS: Use default /Od for now !endif + MSFT:*_*_X64_DLINK_FLAGS = /ALIGN:64 + diff --git a/BootloaderCorePkg/Stage1A/Stage1A.c b/BootloaderCorePkg/Stage1A/Stage1A.c index 528e8ea7..bb94020d 100644 --- a/BootloaderCorePkg/Stage1A/Stage1A.c +++ b/BootloaderCorePkg/Stage1A/Stage1A.c @@ -173,6 +173,18 @@ PrepareStage1B ( LOADER_COMPRESSED_HEADER *Hdr; UINT8 SignHashAlg; +#if FixedPcdGetBool(PcdFipsSupport) + /* If FIPS is enabled, run FIPS self tests before any crypto algorithm is run. + Halt execution if any FIPS self test fails + */ + Status = RunFipsSelftests (); + if (EFI_ERROR(Status)) { + CpuHalt ("FIPS Self Test Failed"); + } + DEBUG((DEBUG_INFO, "FIPS Self-tests Status = Success\n")); + AddMeasurePoint (0x10D0); +#endif + // Load Stage 1B Status = GetComponentInfo (FLASH_MAP_SIG_STAGE1B, &Src, &Length); if (EFI_ERROR (Status)) { diff --git a/BootloaderCorePkg/Stage1A/Stage1A.h b/BootloaderCorePkg/Stage1A/Stage1A.h index a45e5042..4bbe8cfd 100644 --- a/BootloaderCorePkg/Stage1A/Stage1A.h +++ b/BootloaderCorePkg/Stage1A/Stage1A.h @@ -37,6 +37,7 @@ #include #include #include +#include /** Continue Stage 1A execution. diff --git a/BootloaderCorePkg/Stage1A/Stage1A.inf b/BootloaderCorePkg/Stage1A/Stage1A.inf index 0feef932..de1e2350 100755 --- a/BootloaderCorePkg/Stage1A/Stage1A.inf +++ b/BootloaderCorePkg/Stage1A/Stage1A.inf @@ -58,6 +58,7 @@ ExtraBaseLib StageLib TopSwapLib + CryptoLib [Guids] gPlatformModuleTokenSpaceGuid @@ -92,5 +93,8 @@ gPlatformCommonLibTokenSpaceGuid.PcdCompSignHashAlg gPlatformModuleTokenSpaceGuid.PcdIdenticalTopSwapsBuilt +[FixedPcd] + gPlatformCommonLibTokenSpaceGuid.PcdFipsSupport + [Depex] TRUE diff --git a/BuildLoader.py b/BuildLoader.py index 9671c9c8..3f28fbce 100755 --- a/BuildLoader.py +++ b/BuildLoader.py @@ -182,6 +182,7 @@ class BaseBoard(object): self.ENABLE_SMM_REBASE = 0 self.ENABLE_IPP_CRYPTO_PERF = 0 self.ENABLE_UPL_HANDOFF_FDT = 0 + self.ENABLE_FIPS_SELFTEST = 0 self.SUPPORT_ARI = 0 self.SUPPORT_SR_IOV = 0 diff --git a/Platform/ArrowlakeBoardPkg/BoardConfigArlh.py b/Platform/ArrowlakeBoardPkg/BoardConfigArlh.py index fe8e8c03..7e57536e 100644 --- a/Platform/ArrowlakeBoardPkg/BoardConfigArlh.py +++ b/Platform/ArrowlakeBoardPkg/BoardConfigArlh.py @@ -73,6 +73,7 @@ class Board(BaseBoard): self.ENABLE_SMM_REBASE = 2 # 0: Disable 1: Enable IPP Crypto performance mesurement self.ENABLE_IPP_CRYPTO_PERF = 0 + self.ENABLE_FIPS_SELFTEST = 0 # 0 - PCH UART0, 1 - PCH UART1, 2 - PCH UART2, 0xFF - EC UART 0x3F8 self.DEBUG_PORT_NUMBER = 0xFF @@ -123,6 +124,8 @@ class Board(BaseBoard): self.STAGE2_XIP = 0 self.STAGE1A_SIZE = 0x00020000 + if self.ENABLE_FIPS_SELFTEST: + self.STAGE1A_SIZE += 0x0000A000 self.STAGE1_STACK_SIZE = 0x00003000 self.STAGE1_DATA_SIZE = 0x00014000 self.FSP_M_STACK_TOP = 0xFEFDFF00 @@ -172,7 +175,7 @@ class Board(BaseBoard): # If BUILD_IDENTICAL_TS is 0, the flash map sizings and layout # will need to be adjusted so that uCode and Stage 1B are in - # redudant partition + # redundant partition self.BUILD_IDENTICAL_TS = 1 # If ENABLE_SBL_RESILIENCY is 1, BiosRedAssistance FIT strap setting @@ -406,6 +409,10 @@ class Board(BaseBoard): dsc['PcdsFixedAtBuild'] = ['gPlatformModuleTokenSpaceGuid.PcdAcpiTablesMaxEntry | 40'] + if self.ENABLE_FIPS_SELFTEST: + dsc['PcdsFixedAtBuild'].append ('gPlatformCommonLibTokenSpaceGuid.PcdFipsSupport | TRUE') + + dsc['PcdsFixedAtBuild'].append ('gPlatformCommonLibTokenSpaceGuid.PcdIppcrypto2Lib | TRUE') return dsc diff --git a/Platform/ArrowlakeBoardPkg/BoardConfigArls.py b/Platform/ArrowlakeBoardPkg/BoardConfigArls.py index cb360a0b..5b781394 100644 --- a/Platform/ArrowlakeBoardPkg/BoardConfigArls.py +++ b/Platform/ArrowlakeBoardPkg/BoardConfigArls.py @@ -74,6 +74,7 @@ class Board(BaseBoard): self.ENABLE_SMM_REBASE = 2 # 0: Disable 1: Enable IPP Crypto performance mesurement self.ENABLE_IPP_CRYPTO_PERF = 0 + self.ENABLE_FIPS_SELFTEST = 0 # 0 - PCH UART0, 1 - PCH UART1, 2 - PCH UART2, 0xFF - EC UART 0x3F8 self.DEBUG_PORT_NUMBER = 0x2 @@ -124,6 +125,8 @@ class Board(BaseBoard): self.STAGE2_XIP = 0 self.STAGE1A_SIZE = 0x00020000 + if self.ENABLE_FIPS_SELFTEST: + self.STAGE1A_SIZE += 0x0000B000 self.STAGE1_STACK_SIZE = 0x00003000 self.STAGE1_DATA_SIZE = 0x00014000 self.FSP_M_STACK_TOP = 0xFEFDFF00 @@ -411,6 +414,11 @@ class Board(BaseBoard): if self._S_SUPPORT: dsc['PcdsFixedAtBuild'].append ('gPlatformArrowLakeTokenSpaceGuid.PcdMtlSSupport | TRUE') + if self.ENABLE_FIPS_SELFTEST: + dsc['PcdsFixedAtBuild'].append ('gPlatformCommonLibTokenSpaceGuid.PcdFipsSupport | TRUE') + + dsc['PcdsFixedAtBuild'].append ('gPlatformCommonLibTokenSpaceGuid.PcdIppcrypto2Lib | TRUE') + return dsc