Correct the Hash Calculation for Revoked X.509 Certificate to align with RFC3280 and UEFI 2.4 Spec.

This patch added one new X509GetTBSCert() interface in BaseCryptLib to retrieve the TBSCertificate, 
and also corrected the hash calculation for revoked certificate to aligned the RFC3280 and UEFI 2.4 spec.

Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: "Long, Qin" <qin.long@intel.com>
Reviewed-by: "Dong, Guo" <guo.dong@initel.com>

git-svn-id: https://svn.code.sf.net/p/edk2/code/trunk/edk2@16559 6f19259b-4bc3-4df7-8a09-765794883524

1 files changed, 10 insertions, 1 deletions

diff --git a/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigImpl.c b/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigImpl.c
index 517d9d9904..5b8ae7e8d8 100644
--- a/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigImpl.c
+++ b/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigImpl.c
@@ -1073,6 +1073,8 @@ CalculateCertHash (
   BOOLEAN                   Status;

   VOID                      *HashCtx;

   UINTN                     CtxSize;

+  UINT8                     *TBSCert;

+  UINTN                     TBSCertSize;

 

   HashCtx = NULL;

   Status  = FALSE;

@@ -1082,6 +1084,13 @@ CalculateCertHash (
   }

 

   //

+  // Retrieve the TBSCertificate for Hash Calculation.

+  //

+  if (!X509GetTBSCert (CertData, CertSize, &TBSCert, &TBSCertSize)) {

+    return FALSE;

+  }

+

+  //

   // 1. Initialize context of hash.

   //

   CtxSize = mHash[HashAlg].GetContextSize ();

@@ -1099,7 +1108,7 @@ CalculateCertHash (
   //

   // 3. Calculate the hash.

   //

-  Status  = mHash[HashAlg].HashUpdate (HashCtx, CertData, CertSize);

+  Status  = mHash[HashAlg].HashUpdate (HashCtx, TBSCert, TBSCertSize);

   if (!Status) {

     goto Done;

   }